Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Payment TT Copy.PDF.exe

Overview

General Information

Sample name:Payment TT Copy.PDF.exe
Analysis ID:1519410
MD5:25e0c13b707f3ebce3f35e806ac547d7
SHA1:647c3a60022eaa64b8d43c92834f0d040f305ccf
SHA256:1a375dd13598cd93e502e68f84236b536b9333fc9f1f2db88f2bbbbc67dd04c4
Tags:AlphaBankexegeoGRCuser-NDA0E
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Double Extension File Execution
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Payment TT Copy.PDF.exe (PID: 5632 cmdline: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • powershell.exe (PID: 5324 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 3880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 6708 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 6816 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • schtasks.exe (PID: 5308 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Payment TT Copy.PDF.exe (PID: 4044 cmdline: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • Payment TT Copy.PDF.exe (PID: 5168 cmdline: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • Payment TT Copy.PDF.exe (PID: 6424 cmdline: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • Payment TT Copy.PDF.exe (PID: 6928 cmdline: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • Payment TT Copy.PDF.exe (PID: 828 cmdline: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • svchost.exe (PID: 6928 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • VajtonZVfAG.exe (PID: 4864 cmdline: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • schtasks.exe (PID: 5876 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • VajtonZVfAG.exe (PID: 5840 cmdline: "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
    • VajtonZVfAG.exe (PID: 3820 cmdline: "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe" MD5: 25E0C13B707F3EBCE3F35E806AC547D7)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2bc80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13def:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2ecc3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x16e32:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      Process Memory Space: Payment TT Copy.PDF.exe PID: 5632JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2ecc3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16e32:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          13.2.Payment TT Copy.PDF.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            13.2.Payment TT Copy.PDF.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2dec3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x16032:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Suspicious Double Extension File Execution
            Source: Process startedAuthor: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine|base64offset|contains: M, Image: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, NewProcessName: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, OriginalFileName: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ProcessId: 5632, ProcessName: Payment TT Copy.PDF.exe
            Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ParentImage: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentProcessId: 5632, ParentProcessName: Payment TT Copy.PDF.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ProcessId: 5324, ProcessName: powershell.exe
            Sigma detected: Powershell Defender Exclusion
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ParentImage: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentProcessId: 5632, ParentProcessName: Payment TT Copy.PDF.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ProcessId: 5324, ProcessName: powershell.exe
            Sigma detected: Suspicious Add Scheduled Task Parent
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe, ParentImage: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe, ParentProcessId: 4864, ParentProcessName: VajtonZVfAG.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp", ProcessId: 5876, ProcessName: schtasks.exe
            Sigma detected: Suspicious Schtasks From Env Var Folder
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ParentImage: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentProcessId: 5632, ParentProcessName: Payment TT Copy.PDF.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp", ProcessId: 5308, ProcessName: schtasks.exe
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ParentImage: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentProcessId: 5632, ParentProcessName: Payment TT Copy.PDF.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 6928, ProcessName: svchost.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ParentImage: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentProcessId: 5632, ParentProcessName: Payment TT Copy.PDF.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ProcessId: 5324, ProcessName: powershell.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ParentImage: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentProcessId: 5632, ParentProcessName: Payment TT Copy.PDF.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 6928, ProcessName: svchost.exe

            Persistence and Installation Behavior

            barindex
            Sigma detected: Scheduled temp file as task from temp location
            Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Payment TT Copy.PDF.exe", ParentImage: C:\Users\user\Desktop\Payment TT Copy.PDF.exe, ParentProcessId: 5632, ParentProcessName: Payment TT Copy.PDF.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp", ProcessId: 5308, ProcessName: schtasks.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for dropped file
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeReversingLabs: Detection: 26%
            Multi AV Scanner detection for submitted file
            Source: Payment TT Copy.PDF.exeReversingLabs: Detection: 26%
            Yara detected FormBook
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for dropped file
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: Payment TT Copy.PDF.exeJoe Sandbox ML: detected
            Source: Payment TT Copy.PDF.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: Payment TT Copy.PDF.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: vysx.pdb source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.dr
            Source: Binary string: wntdll.pdbUGP source: Payment TT Copy.PDF.exe, 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: Payment TT Copy.PDF.exe, Payment TT Copy.PDF.exe, 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: vysx.pdbSHA256 source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.dr
            Source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.drString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
            Source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.drString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
            Source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.drString found in binary or memory: http://ocsp.comodoca.com0
            Source: Payment TT Copy.PDF.exe, 00000000.00000002.2127687121.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, VajtonZVfAG.exe, 0000000E.00000002.2177704253.0000000002E99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.drString found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 13.2.Payment TT Copy.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: Payment TT Copy.PDF.exe
            Source: initial sampleStatic PE information: Filename: Payment TT Copy.PDF.exe
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0042BFE3 NtClose,13_2_0042BFE3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62B60 NtClose,LdrInitializeThunk,13_2_00F62B60
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62C70 NtFreeVirtualMemory,LdrInitializeThunk,13_2_00F62C70
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62DF0 NtQuerySystemInformation,LdrInitializeThunk,13_2_00F62DF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F635C0 NtCreateMutant,LdrInitializeThunk,13_2_00F635C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F64340 NtSetContextThread,13_2_00F64340
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F64650 NtSuspendThread,13_2_00F64650
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62AF0 NtWriteFile,13_2_00F62AF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62AD0 NtReadFile,13_2_00F62AD0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62AB0 NtWaitForSingleObject,13_2_00F62AB0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62BF0 NtAllocateVirtualMemory,13_2_00F62BF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62BE0 NtQueryValueKey,13_2_00F62BE0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62BA0 NtEnumerateValueKey,13_2_00F62BA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62B80 NtQueryInformationFile,13_2_00F62B80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62CF0 NtOpenProcess,13_2_00F62CF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62CC0 NtQueryVirtualMemory,13_2_00F62CC0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62CA0 NtQueryInformationToken,13_2_00F62CA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62C60 NtCreateKey,13_2_00F62C60
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62C00 NtQueryInformationProcess,13_2_00F62C00
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62DD0 NtDelayExecution,13_2_00F62DD0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62DB0 NtEnumerateKey,13_2_00F62DB0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62D30 NtUnmapViewOfSection,13_2_00F62D30
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62D10 NtMapViewOfSection,13_2_00F62D10
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62D00 NtSetInformationFile,13_2_00F62D00
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62EE0 NtQueueApcThread,13_2_00F62EE0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62EA0 NtAdjustPrivilegesToken,13_2_00F62EA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62E80 NtReadVirtualMemory,13_2_00F62E80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62E30 NtWriteVirtualMemory,13_2_00F62E30
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62FE0 NtCreateFile,13_2_00F62FE0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62FB0 NtResumeThread,13_2_00F62FB0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62FA0 NtQuerySection,13_2_00F62FA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62F90 NtProtectVirtualMemory,13_2_00F62F90
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62F60 NtCreateProcessEx,13_2_00F62F60
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62F30 NtCreateSection,13_2_00F62F30
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F63090 NtSetValueKey,13_2_00F63090
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F63010 NtOpenDirectoryObject,13_2_00F63010
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F639B0 NtGetContextThread,13_2_00F639B0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F63D70 NtOpenThread,13_2_00F63D70
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F63D10 NtOpenProcessToken,13_2_00F63D10
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_0155DEEC0_2_0155DEEC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B19000_2_075B1900
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B47B80_2_075B47B8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B64500_2_075B6450
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B64410_2_075B6441
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B43800_2_075B4380
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075BD0E80_2_075BD0E8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B6E000_2_075B6E00
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B4BF00_2_075B4BF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B4BE00_2_075B4BE0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B19820_2_075B1982
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B18EF0_2_075B18EF
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0040F84A13_2_0040F84A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0040F85313_2_0040F853
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_004010CA13_2_004010CA
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_004010D013_2_004010D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_004161A313_2_004161A3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0040FA7313_2_0040FA73
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0040123013_2_00401230
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_004022C013_2_004022C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0040DAF313_2_0040DAF3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00402DC013_2_00402DC0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0042E5B313_2_0042E5B3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0040264013_2_00402640
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC200013_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE81CC13_2_00FE81CC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF01AA13_2_00FF01AA
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE41A213_2_00FE41A2
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB815813_2_00FB8158
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCA11813_2_00FCA118
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2010013_2_00F20100
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB02C013_2_00FB02C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD027413_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E3F013_2_00F3E3F0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF03E613_2_00FF03E6
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEA35213_2_00FEA352
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDE4F613_2_00FDE4F6
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE244613_2_00FE2446
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD442013_2_00FD4420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF059113_2_00FF0591
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3053513_2_00F30535
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4C6E013_2_00F4C6E0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2C7C013_2_00F2C7C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3077013_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5475013_2_00F54750
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E8F013_2_00F5E8F0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F168B813_2_00F168B8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3A84013_2_00F3A840
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3284013_2_00F32840
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A013_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FFA9A613_2_00FFA9A6
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4696213_2_00F46962
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA8013_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE6BD713_2_00FE6BD7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEAB4013_2_00FEAB40
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20CF213_2_00F20CF2
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0CB513_2_00FD0CB5
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30C0013_2_00F30C00
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2ADE013_2_00F2ADE0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F48DBF13_2_00F48DBF
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCCD1F13_2_00FCCD1F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3AD0013_2_00F3AD00
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEEEDB13_2_00FEEEDB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F42E9013_2_00F42E90
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FECE9313_2_00FECE93
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30E5913_2_00F30E59
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEEE2613_2_00FEEE26
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3CFE013_2_00F3CFE0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F22FC813_2_00F22FC8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAEFA013_2_00FAEFA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA4F4013_2_00FA4F40
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F50F3013_2_00F50F30
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD2F3013_2_00FD2F30
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F72F2813_2_00F72F28
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE70E913_2_00FE70E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEF0E013_2_00FEF0E0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDF0CC13_2_00FDF0CC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F370C013_2_00F370C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3B1B013_2_00F3B1B0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1F17213_2_00F1F172
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FFB16B13_2_00FFB16B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F6516C13_2_00F6516C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD12ED13_2_00FD12ED
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4B2C013_2_00F4B2C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F352A013_2_00F352A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F7739A13_2_00F7739A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1D34C13_2_00F1D34C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE132D13_2_00FE132D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2146013_2_00F21460
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEF43F13_2_00FEF43F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF95C313_2_00FF95C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCD5B013_2_00FCD5B0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE757113_2_00FE7571
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE16CC13_2_00FE16CC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F7563013_2_00F75630
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEF7B013_2_00FEF7B0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F338E013_2_00F338E0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9D80013_2_00F9D800
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3995013_2_00F39950
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4B95013_2_00F4B950
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC591013_2_00FC5910
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDDAC613_2_00FDDAC6
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCDAAC13_2_00FCDAAC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F75AA013_2_00F75AA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD1AA313_2_00FD1AA3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA3A6C13_2_00FA3A6C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEFA4913_2_00FEFA49
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE7A4613_2_00FE7A46
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA5BF013_2_00FA5BF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F6DBF913_2_00F6DBF9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4FB8013_2_00F4FB80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEFB7613_2_00FEFB76
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEFCF213_2_00FEFCF2
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA9C3213_2_00FA9C32
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4FDC013_2_00F4FDC0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE7D7313_2_00FE7D73
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE1D5A13_2_00FE1D5A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F33D4013_2_00F33D40
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F39EB013_2_00F39EB0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEFFB113_2_00FEFFB1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F31F9213_2_00F31F92
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEFF0913_2_00FEFF09
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0132DEEC14_2_0132DEEC
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_02D0004014_2_02D00040
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_02D0000714_2_02D00007
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0739190014_2_07391900
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0739BF2814_2_0739BF28
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_073947B814_2_073947B8
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_07396E0014_2_07396E00
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0739645014_2_07396450
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0739644114_2_07396441
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0739438014_2_07394380
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_07394BF014_2_07394BF0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_07394BE014_2_07394BE0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0739115714_2_07391157
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_0739198214_2_07391982
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_073918EF14_2_073918EF
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017B010019_2_017B0100
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_0180600019_2_01806000
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_018402C019_2_018402C0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C053519_2_017C0535
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C077019_2_017C0770
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017E475019_2_017E4750
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017BC7C019_2_017BC7C0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017DC6E019_2_017DC6E0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017D696219_2_017D6962
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C29A019_2_017C29A0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017CA84019_2_017CA840
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C284019_2_017C2840
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017EE8F019_2_017EE8F0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017A68B819_2_017A68B8
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017F889019_2_017F8890
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017BEA8019_2_017BEA80
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017CED7A19_2_017CED7A
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017CAD0019_2_017CAD00
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017BADE019_2_017BADE0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C8DC019_2_017C8DC0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017D8DBF19_2_017D8DBF
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C0C0019_2_017C0C00
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017B0CF219_2_017B0CF2
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_0183EFA019_2_0183EFA0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017E0F3019_2_017E0F30
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_01802F2819_2_01802F28
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017B2FC819_2_017B2FC8
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_01834F4019_2_01834F40
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C0E5919_2_017C0E59
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017D2E9019_2_017D2E90
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017AF17219_2_017AF172
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017F516C19_2_017F516C
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017CB1B019_2_017CB1B0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017AD34C19_2_017AD34C
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C33F319_2_017C33F3
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017DD2F019_2_017DD2F0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017DB2C019_2_017DB2C0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C52A019_2_017C52A0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017B146019_2_017B1460
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_018074E019_2_018074E0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C349719_2_017C3497
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017CB73019_2_017CB730
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C995019_2_017C9950
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017DB95019_2_017DB950
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C599019_2_017C5990
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_0182D80019_2_0182D800
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C38E019_2_017C38E0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_01835BF019_2_01835BF0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017FDBF919_2_017FDBF9
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017DFB8019_2_017DFB80
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_01833A6C19_2_01833A6C
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C3D4019_2_017C3D40
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017DFDC019_2_017DFDC0
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017D9C2019_2_017D9C20
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_01839C3219_2_01839C32
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C1F9219_2_017C1F92
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017C9EB019_2_017C9EB0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: String function: 00F65130 appears 58 times
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: String function: 00FAF290 appears 105 times
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: String function: 00F77E54 appears 111 times
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: String function: 00F1B970 appears 280 times
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: String function: 00F9EA12 appears 86 times
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: String function: 0182EA12 appears 37 times
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: String function: 01807E54 appears 97 times
            Source: Payment TT Copy.PDF.exeStatic PE information: invalid certificate
            Source: Payment TT Copy.PDF.exe, 00000000.00000002.2147183357.0000000007F80000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs Payment TT Copy.PDF.exe
            Source: Payment TT Copy.PDF.exe, 00000000.00000002.2146677318.0000000007AE8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameh vs Payment TT Copy.PDF.exe
            Source: Payment TT Copy.PDF.exe, 00000000.00000000.2097070980.0000000000BA2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamevysx.exe> vs Payment TT Copy.PDF.exe
            Source: Payment TT Copy.PDF.exe, 00000000.00000002.2116090602.000000000119E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Payment TT Copy.PDF.exe
            Source: Payment TT Copy.PDF.exe, 0000000D.00000002.2167161985.000000000101D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Payment TT Copy.PDF.exe
            Source: Payment TT Copy.PDF.exeBinary or memory string: OriginalFilenamevysx.exe> vs Payment TT Copy.PDF.exe
            Source: Payment TT Copy.PDF.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 13.2.Payment TT Copy.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: Payment TT Copy.PDF.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: VajtonZVfAG.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, dMEHjpgLgkpneUikvJ.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, RBypbDhhDrVS7AathM.csSecurity API names: _0020.SetAccessControl
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, RBypbDhhDrVS7AathM.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, RBypbDhhDrVS7AathM.csSecurity API names: _0020.AddAccessRule
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, dMEHjpgLgkpneUikvJ.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, RBypbDhhDrVS7AathM.csSecurity API names: _0020.SetAccessControl
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, RBypbDhhDrVS7AathM.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, RBypbDhhDrVS7AathM.csSecurity API names: _0020.AddAccessRule
            Source: classification engineClassification label: mal100.troj.evad.winEXE@30/15@0/0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeFile created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5272:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3880:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_03
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeFile created: C:\Users\user\AppData\Local\Temp\tmp78CA.tmpJump to behavior
            Source: Payment TT Copy.PDF.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: Payment TT Copy.PDF.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Payment TT Copy.PDF.exeReversingLabs: Detection: 26%
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeFile read: C:\Users\user\Desktop\Payment TT Copy.PDF.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp"
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: unknownProcess created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe C:\Users\user\AppData\Roaming\VajtonZVfAG.exe
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp"
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
            Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: licensemanagersvc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: licensemanager.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: Payment TT Copy.PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: Payment TT Copy.PDF.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Payment TT Copy.PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: vysx.pdb source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.dr
            Source: Binary string: wntdll.pdbUGP source: Payment TT Copy.PDF.exe, 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: Payment TT Copy.PDF.exe, Payment TT Copy.PDF.exe, 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: vysx.pdbSHA256 source: Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.dr

            Data Obfuscation

            barindex
            .NET source code contains potential unpacker
            Source: Payment TT Copy.PDF.exe, MainForm.cs.Net Code: InitializeComponent
            Source: VajtonZVfAG.exe.0.dr, MainForm.cs.Net Code: InitializeComponent
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, RBypbDhhDrVS7AathM.cs.Net Code: hea2mJKgcR System.Reflection.Assembly.Load(byte[])
            Source: 0.2.Payment TT Copy.PDF.exe.5a00000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
            Source: 0.2.Payment TT Copy.PDF.exe.2f7a208.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
            Source: 0.2.Payment TT Copy.PDF.exe.2f6d9e0.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, RBypbDhhDrVS7AathM.cs.Net Code: hea2mJKgcR System.Reflection.Assembly.Load(byte[])
            Source: 0.2.Payment TT Copy.PDF.exe.2fc9a1c.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
            Source: 0.2.Payment TT Copy.PDF.exe.2fbc86c.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
            Source: Payment TT Copy.PDF.exeStatic PE information: 0xA55FACED [Sun Dec 2 09:27:09 2057 UTC]
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B04EB push ecx; ret 0_2_075B04EC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B1106 push ebx; retf 0_2_075B111A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 0_2_075B3DC7 push edx; ret 0_2_075B3DCB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00403040 push eax; ret 13_2_00403042
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00415040 push eax; iretd 13_2_00415043
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00406167 push ebp; ret 13_2_0040616B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00413560 push 00000076h; iretd 13_2_0041356F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0041EF5B push ss; ret 13_2_0041EF97
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00423720 pushfd ; ret 13_2_00423738
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_0041EFB8 push ss; ret 13_2_0041EF97
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00EF225F pushad ; ret 13_2_00EF27F9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00EF27FA pushad ; ret 13_2_00EF27F9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00EF283D push eax; iretd 13_2_00EF2858
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F209AD push ecx; mov dword ptr [esp], ecx13_2_00F209B6
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00EF1368 push eax; iretd 13_2_00EF1369
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_02D0EB08 pushfd ; iretd 14_2_02D0EB09
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_07393DC8 push edx; ret 14_2_07393DCB
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 14_2_073904EB push ecx; ret 14_2_073904EC
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017FC54D pushfd ; ret 19_2_017FC54E
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017FC9D7 push edi; ret 19_2_017FC9D9
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_017B09AD push ecx; mov dword ptr [esp], ecx19_2_017B09B6
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_01781FEC push eax; iretd 19_2_01781FED
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeCode function: 19_2_01807E99 push ecx; ret 19_2_01807EAC
            Source: Payment TT Copy.PDF.exeStatic PE information: section name: .text entropy: 7.841420186356563
            Source: VajtonZVfAG.exe.0.drStatic PE information: section name: .text entropy: 7.841420186356563
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, Jom9LF10HHRdVrln7yk.csHigh entropy of concatenated method names: 'BDiO17HcrO', 'mdkOY9CXnK', 'DQNOmYDYZD', 'RK1OpGX9Ci', 'W45OeGobun', 'psAOWedCSk', 'Fe8OixokDF', 'a1yOVtHy8c', 'nqEOcSK0Cp', 'Ma6ObbPQa6'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, NynZVPIgXQvWDJeDSi.csHigh entropy of concatenated method names: 'lidmYnTf6', 'otWppmljF', 'YqWWVQ3Pn', 'GpWiYAC8D', 'r6wcXGceK', 'SiFb6qp7k', 'aFxNwlMr7Jf8Gwi77y', 'xInqIB8bijPtdX9voa', 'EUYn2YPXp', 'UbdkyiUIc'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, RBypbDhhDrVS7AathM.csHigh entropy of concatenated method names: 'K3nIQv2thQ', 'x8lIvmNFDG', 'XFVIq557Ds', 'DgeIKvJoNb', 'eJ5IDMn3xP', 'ergIrtSiFF', 'sTgIGhGX5O', 'Hj7IFbGJZY', 'cWfIP8UP21', 'PyoI35aoFD'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, dMEHjpgLgkpneUikvJ.csHigh entropy of concatenated method names: 'aZvq0I5BJS', 'CpFqjBbvuV', 'vZFqgji7in', 'lkrq8flCvc', 'uRlqN9S38I', 'bVaqHN35sI', 'ABqqoTJ6ay', 'fp0qCFYp04', 'GkaqAKYmgT', 'pTGq5oeIy6'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, y9FXtZZQduItxqIplZ.csHigh entropy of concatenated method names: 'Gt56M9UMOD', 'zys6RBWZIe', 'EZs60fHqIa', 'M6M6jBP0qA', 'QgS6x5IQhs', 'MSL6woAVYe', 'aRQ6S3KmPl', 'ktC64VVJvY', 'n0b6fXpBtw', 'xq16ht486k'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, xfyPKow3lFF1jNUg6r.csHigh entropy of concatenated method names: 'qlg7ChNIVW', 'L2r75OrsaN', 'Jdrnsh41x4', 'c0unygwmuI', 'DgN7J3RMYE', 'QGY7RrpjD5', 'hl37Zkvr4Q', 'PRj70SoaBM', 'Bsj7jlJKca', 'r1m7g1QdKI'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, Qxy3IX6wCrgnogBVFg.csHigh entropy of concatenated method names: 'ToString', 'MspBJvJRr7', 'CbRBxM2mFN', 'rULBwpsxZw', 'o3XBSQkpAb', 'r72B4WXYws', 'DQiBfYqPQS', 'vbgBhYqZKB', 'NvOBXJKu2s', 'a23BUqC8uR'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, M6ngbr5bXOptCR8PEO.csHigh entropy of concatenated method names: 'cQ6De8le3c', 'khtDipwSEl', 'Kr8Kwls2qK', 'PY5KSq5n42', 'IFdK44s8gf', 'Cb5KfK1fRH', 'KcSKh0AM0B', 'h9SKXBgJc3', 'qrpKU868GE', 'i9bKMt64K5'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, t9tVbiV0uPTUYfS1dW.csHigh entropy of concatenated method names: 'VhkrQiEtlO', 'KcLrqvWG3M', 'qfcrDfUAHv', 'qVBrGV512w', 'MSmrFPfg7S', 'vXoDNQatvg', 'tZkDHyVrQv', 'pAqDoGGLo4', 'JaiDCLUTXV', 'SOTDAXui2v'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, eCwvkyYw2voigtMyuf.csHigh entropy of concatenated method names: 'Dispose', 's4ZyAPMsJ3', 'QvGdxhFvTk', 'zXCll878ix', 'XXJy5ZA1CU', 'A2cyzvykD0', 'ProcessDialogKey', 'W4adsN6WRk', 'RmVdyp6ID0', 'iujddq2WKO'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, e44qn8M52P8GCkIp9P.csHigh entropy of concatenated method names: 'tCH73mH031', 'uUE79kDDow', 'ToString', 'pDE7vr93Te', 'RAe7q2EpmH', 'Xct7KaQxa0', 'eJK7Dpsq6w', 'X2s7r12t5y', 'bOj7GDb6TZ', 'HR97FIZDxC'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, hciy9U1fMqouS4CXbnu.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OLtk0OPPJp', 'IafkjydZHR', 'BxBkg4w8uL', 'ypHk8SXlTb', 'NybkNYXFB4', 'hfNkHRnqjs', 'Bx7kox48Am'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, pPdWsx11eD9j2f3e7wZ.csHigh entropy of concatenated method names: 'ToString', 'QmIkINlAM0', 'r93k21VvJV', 'WmXkQfbhW2', 'S6FkvBEAOX', 'i5Hkq7UfKq', 'T6skKhrp76', 'xjvkDbbgcM', 'zPGFrQIesnxCkOfMAG7', 'dYYEdmIaPShsVNMccI9'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, Nou66DloiqYx4178FS.csHigh entropy of concatenated method names: 'MSDG1NOSyn', 'MakGYpXNWM', 'EAmGmjaLgC', 'qhCGpHbQXB', 'ws8Ge8Ymad', 'w3yGW0ykb1', 'bXwGieFxfh', 'CksGVbetye', 'QByGcigtIF', 'GD4GbcTF7P'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, C86G4ZDECc2GTFZTYL.csHigh entropy of concatenated method names: 'IdeKpyeZcu', 'OUTKWsnCvs', 'rmLKVFRbem', 'IUPKctApE3', 'i9xK6O5bnJ', 'zx2KBG4H94', 'rk5K7ek2hh', 'dAIKn9wJDG', 'DowKOfdC5A', 'nK3Kk7caqC'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, jZcqeZ3FX7MH3R5KrW.csHigh entropy of concatenated method names: 'splOyUZ5jP', 'TFAOIIFlW7', 'XU2O2UIe1t', 'ON4OvjJXAC', 'v9vOqUA5Fy', 'JDSODy7u6T', 'JAqOrYg1OY', 'AANnoSohip', 'KnOnCrWG6l', 'gcpnAYLOHv'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, lfkj82aySIExnQ9DGG.csHigh entropy of concatenated method names: 'yNBLVDBZsy', 'KYcLcmjnp5', 'SHsLTmZgSD', 'iqnLxptXkP', 'XapLSs1Lf8', 'PSZL42pGlj', 'RvPLhBkdJF', 'MaXLXClqQo', 'GuSLMcnQtX', 'knvLJBESEZ'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, VeVkon4uYBxlo0Z935.csHigh entropy of concatenated method names: 'eLHnTLpuv5', 'WhxnxrhLnB', 'X0EnwoyCJE', 'qfnnS9hIX4', 'hfPn0xInfR', 'fNKn4Fn2eu', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, PfY4hhpdWPrhK6QVIP.csHigh entropy of concatenated method names: 'T0yGvd8HxM', 'h42GKUxQji', 'EsaGrQVKmn', 'wyjr5tYp4P', 'GltrzVwa1c', 'E2gGsxXlYF', 'EDsGyTOTGs', 'KHOGdwXBQc', 'gfiGIA8qK0', 'OWpG2mk7bN'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, zM8kKvzcu2nNZjrZbk.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YDxOLeArle', 'zqiO6WpSdL', 'QG7OB4fpwW', 'eIbO7HBUhu', 'QCnOnK4lNZ', 'Vu9OOD3WeG', 'm1IOkIRxwR'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, GiwBEN7EoeMMlMNy9T.csHigh entropy of concatenated method names: 'AoJyGdlIar', 'l8wyFvoPMS', 'TLLy3fiaVy', 'ic2y98ig4i', 'WyNy6XeVU9', 'FXyyBDyuTD', 'hP0bm0wfSj5VSkCi3K', 'poy3c9sNW1MRT8YYOK', 'c9myydolTV', 'du4yIeB3B4'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, Y6eTJPtAxoYndBNoX2.csHigh entropy of concatenated method names: 'MBtrEXUMnE', 'Sicr1pFo2F', 'HjCrmIU44a', 'kAVrpVwko8', 'FVKrWAMvqj', 'n8GriJ4gUQ', 'Llxrc0JH8y', 'xobrbvID7F', 'uKsFxmSdGUHuteDT76d', 'WpMQaJSRZn03nRYxlXB'
            Source: 0.2.Payment TT Copy.PDF.exe.41f6e20.4.raw.unpack, mEyRMSiXZwHKbxKOdG.csHigh entropy of concatenated method names: 'g1PnvHs4IV', 'fVCnqsHDfu', 'EvVnKBDg3P', 'BdXnDfLfcn', 'j6hnr145Fm', 'SaCnGBc9uV', 'QAKnFWsGZY', 'FdEnPRDMO9', 'XXSn3JYpIn', 'EaWn9CgVcC'
            Source: 0.2.Payment TT Copy.PDF.exe.5a00000.5.raw.unpack, kD0JNdgNBriBGn5egS.csHigh entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
            Source: 0.2.Payment TT Copy.PDF.exe.5a00000.5.raw.unpack, QBy45BY4uMbUQs88Qq.csHigh entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
            Source: 0.2.Payment TT Copy.PDF.exe.2f7a208.2.raw.unpack, kD0JNdgNBriBGn5egS.csHigh entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
            Source: 0.2.Payment TT Copy.PDF.exe.2f7a208.2.raw.unpack, QBy45BY4uMbUQs88Qq.csHigh entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
            Source: 0.2.Payment TT Copy.PDF.exe.2f6d9e0.0.raw.unpack, kD0JNdgNBriBGn5egS.csHigh entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
            Source: 0.2.Payment TT Copy.PDF.exe.2f6d9e0.0.raw.unpack, QBy45BY4uMbUQs88Qq.csHigh entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, Jom9LF10HHRdVrln7yk.csHigh entropy of concatenated method names: 'BDiO17HcrO', 'mdkOY9CXnK', 'DQNOmYDYZD', 'RK1OpGX9Ci', 'W45OeGobun', 'psAOWedCSk', 'Fe8OixokDF', 'a1yOVtHy8c', 'nqEOcSK0Cp', 'Ma6ObbPQa6'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, NynZVPIgXQvWDJeDSi.csHigh entropy of concatenated method names: 'lidmYnTf6', 'otWppmljF', 'YqWWVQ3Pn', 'GpWiYAC8D', 'r6wcXGceK', 'SiFb6qp7k', 'aFxNwlMr7Jf8Gwi77y', 'xInqIB8bijPtdX9voa', 'EUYn2YPXp', 'UbdkyiUIc'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, RBypbDhhDrVS7AathM.csHigh entropy of concatenated method names: 'K3nIQv2thQ', 'x8lIvmNFDG', 'XFVIq557Ds', 'DgeIKvJoNb', 'eJ5IDMn3xP', 'ergIrtSiFF', 'sTgIGhGX5O', 'Hj7IFbGJZY', 'cWfIP8UP21', 'PyoI35aoFD'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, dMEHjpgLgkpneUikvJ.csHigh entropy of concatenated method names: 'aZvq0I5BJS', 'CpFqjBbvuV', 'vZFqgji7in', 'lkrq8flCvc', 'uRlqN9S38I', 'bVaqHN35sI', 'ABqqoTJ6ay', 'fp0qCFYp04', 'GkaqAKYmgT', 'pTGq5oeIy6'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, y9FXtZZQduItxqIplZ.csHigh entropy of concatenated method names: 'Gt56M9UMOD', 'zys6RBWZIe', 'EZs60fHqIa', 'M6M6jBP0qA', 'QgS6x5IQhs', 'MSL6woAVYe', 'aRQ6S3KmPl', 'ktC64VVJvY', 'n0b6fXpBtw', 'xq16ht486k'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, xfyPKow3lFF1jNUg6r.csHigh entropy of concatenated method names: 'qlg7ChNIVW', 'L2r75OrsaN', 'Jdrnsh41x4', 'c0unygwmuI', 'DgN7J3RMYE', 'QGY7RrpjD5', 'hl37Zkvr4Q', 'PRj70SoaBM', 'Bsj7jlJKca', 'r1m7g1QdKI'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, Qxy3IX6wCrgnogBVFg.csHigh entropy of concatenated method names: 'ToString', 'MspBJvJRr7', 'CbRBxM2mFN', 'rULBwpsxZw', 'o3XBSQkpAb', 'r72B4WXYws', 'DQiBfYqPQS', 'vbgBhYqZKB', 'NvOBXJKu2s', 'a23BUqC8uR'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, M6ngbr5bXOptCR8PEO.csHigh entropy of concatenated method names: 'cQ6De8le3c', 'khtDipwSEl', 'Kr8Kwls2qK', 'PY5KSq5n42', 'IFdK44s8gf', 'Cb5KfK1fRH', 'KcSKh0AM0B', 'h9SKXBgJc3', 'qrpKU868GE', 'i9bKMt64K5'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, t9tVbiV0uPTUYfS1dW.csHigh entropy of concatenated method names: 'VhkrQiEtlO', 'KcLrqvWG3M', 'qfcrDfUAHv', 'qVBrGV512w', 'MSmrFPfg7S', 'vXoDNQatvg', 'tZkDHyVrQv', 'pAqDoGGLo4', 'JaiDCLUTXV', 'SOTDAXui2v'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, eCwvkyYw2voigtMyuf.csHigh entropy of concatenated method names: 'Dispose', 's4ZyAPMsJ3', 'QvGdxhFvTk', 'zXCll878ix', 'XXJy5ZA1CU', 'A2cyzvykD0', 'ProcessDialogKey', 'W4adsN6WRk', 'RmVdyp6ID0', 'iujddq2WKO'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, e44qn8M52P8GCkIp9P.csHigh entropy of concatenated method names: 'tCH73mH031', 'uUE79kDDow', 'ToString', 'pDE7vr93Te', 'RAe7q2EpmH', 'Xct7KaQxa0', 'eJK7Dpsq6w', 'X2s7r12t5y', 'bOj7GDb6TZ', 'HR97FIZDxC'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, hciy9U1fMqouS4CXbnu.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OLtk0OPPJp', 'IafkjydZHR', 'BxBkg4w8uL', 'ypHk8SXlTb', 'NybkNYXFB4', 'hfNkHRnqjs', 'Bx7kox48Am'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, pPdWsx11eD9j2f3e7wZ.csHigh entropy of concatenated method names: 'ToString', 'QmIkINlAM0', 'r93k21VvJV', 'WmXkQfbhW2', 'S6FkvBEAOX', 'i5Hkq7UfKq', 'T6skKhrp76', 'xjvkDbbgcM', 'zPGFrQIesnxCkOfMAG7', 'dYYEdmIaPShsVNMccI9'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, Nou66DloiqYx4178FS.csHigh entropy of concatenated method names: 'MSDG1NOSyn', 'MakGYpXNWM', 'EAmGmjaLgC', 'qhCGpHbQXB', 'ws8Ge8Ymad', 'w3yGW0ykb1', 'bXwGieFxfh', 'CksGVbetye', 'QByGcigtIF', 'GD4GbcTF7P'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, C86G4ZDECc2GTFZTYL.csHigh entropy of concatenated method names: 'IdeKpyeZcu', 'OUTKWsnCvs', 'rmLKVFRbem', 'IUPKctApE3', 'i9xK6O5bnJ', 'zx2KBG4H94', 'rk5K7ek2hh', 'dAIKn9wJDG', 'DowKOfdC5A', 'nK3Kk7caqC'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, jZcqeZ3FX7MH3R5KrW.csHigh entropy of concatenated method names: 'splOyUZ5jP', 'TFAOIIFlW7', 'XU2O2UIe1t', 'ON4OvjJXAC', 'v9vOqUA5Fy', 'JDSODy7u6T', 'JAqOrYg1OY', 'AANnoSohip', 'KnOnCrWG6l', 'gcpnAYLOHv'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, lfkj82aySIExnQ9DGG.csHigh entropy of concatenated method names: 'yNBLVDBZsy', 'KYcLcmjnp5', 'SHsLTmZgSD', 'iqnLxptXkP', 'XapLSs1Lf8', 'PSZL42pGlj', 'RvPLhBkdJF', 'MaXLXClqQo', 'GuSLMcnQtX', 'knvLJBESEZ'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, VeVkon4uYBxlo0Z935.csHigh entropy of concatenated method names: 'eLHnTLpuv5', 'WhxnxrhLnB', 'X0EnwoyCJE', 'qfnnS9hIX4', 'hfPn0xInfR', 'fNKn4Fn2eu', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, PfY4hhpdWPrhK6QVIP.csHigh entropy of concatenated method names: 'T0yGvd8HxM', 'h42GKUxQji', 'EsaGrQVKmn', 'wyjr5tYp4P', 'GltrzVwa1c', 'E2gGsxXlYF', 'EDsGyTOTGs', 'KHOGdwXBQc', 'gfiGIA8qK0', 'OWpG2mk7bN'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, zM8kKvzcu2nNZjrZbk.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YDxOLeArle', 'zqiO6WpSdL', 'QG7OB4fpwW', 'eIbO7HBUhu', 'QCnOnK4lNZ', 'Vu9OOD3WeG', 'm1IOkIRxwR'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, GiwBEN7EoeMMlMNy9T.csHigh entropy of concatenated method names: 'AoJyGdlIar', 'l8wyFvoPMS', 'TLLy3fiaVy', 'ic2y98ig4i', 'WyNy6XeVU9', 'FXyyBDyuTD', 'hP0bm0wfSj5VSkCi3K', 'poy3c9sNW1MRT8YYOK', 'c9myydolTV', 'du4yIeB3B4'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, Y6eTJPtAxoYndBNoX2.csHigh entropy of concatenated method names: 'MBtrEXUMnE', 'Sicr1pFo2F', 'HjCrmIU44a', 'kAVrpVwko8', 'FVKrWAMvqj', 'n8GriJ4gUQ', 'Llxrc0JH8y', 'xobrbvID7F', 'uKsFxmSdGUHuteDT76d', 'WpMQaJSRZn03nRYxlXB'
            Source: 0.2.Payment TT Copy.PDF.exe.7f80000.6.raw.unpack, mEyRMSiXZwHKbxKOdG.csHigh entropy of concatenated method names: 'g1PnvHs4IV', 'fVCnqsHDfu', 'EvVnKBDg3P', 'BdXnDfLfcn', 'j6hnr145Fm', 'SaCnGBc9uV', 'QAKnFWsGZY', 'FdEnPRDMO9', 'XXSn3JYpIn', 'EaWn9CgVcC'
            Source: 0.2.Payment TT Copy.PDF.exe.2fc9a1c.1.raw.unpack, kD0JNdgNBriBGn5egS.csHigh entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
            Source: 0.2.Payment TT Copy.PDF.exe.2fc9a1c.1.raw.unpack, QBy45BY4uMbUQs88Qq.csHigh entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
            Source: 0.2.Payment TT Copy.PDF.exe.2fbc86c.3.raw.unpack, kD0JNdgNBriBGn5egS.csHigh entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
            Source: 0.2.Payment TT Copy.PDF.exe.2fbc86c.3.raw.unpack, QBy45BY4uMbUQs88Qq.csHigh entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeFile created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeJump to dropped file

            Boot Survival

            barindex
            Uses schtasks.exe or at.exe to add and modify task schedules
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp"

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Uses an obfuscated file name to hide its real file extension (double extension)
            Source: Possible double extension: pdf.exeStatic PE information: Payment TT Copy.PDF.exe
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Yara detected AntiVM3
            Source: Yara matchFile source: Process Memory Space: Payment TT Copy.PDF.exe PID: 5632, type: MEMORYSTR
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: 1510000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: 2F30000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: 2E60000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: 8150000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: 9150000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: 9310000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: A310000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory allocated: 1080000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory allocated: 2E30000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory allocated: 4E30000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory allocated: 7B60000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory allocated: 8B60000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory allocated: 8D10000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory allocated: 9D10000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F6096E rdtsc 13_2_00F6096E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2995Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4325Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeAPI coverage: 0.6 %
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeAPI coverage: 0.3 %
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exe TID: 2940Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5636Thread sleep count: 2995 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6052Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2444Thread sleep count: 87 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1548Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5904Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6772Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exe TID: 5812Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe TID: 3300Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe TID: 2940Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: Payment TT Copy.PDF.exe, 00000000.00000002.2147183357.0000000007F80000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: QEMuI3f6HdgIrd9fgRr
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F6096E rdtsc 13_2_00F6096E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00417153 LdrLoadDll,13_2_00417153
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1C0F0 mov eax, dword ptr fs:[00000030h]13_2_00F1C0F0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F620F0 mov ecx, dword ptr fs:[00000030h]13_2_00F620F0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1A0E3 mov ecx, dword ptr fs:[00000030h]13_2_00F1A0E3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA60E0 mov eax, dword ptr fs:[00000030h]13_2_00FA60E0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F280E9 mov eax, dword ptr fs:[00000030h]13_2_00F280E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA20DE mov eax, dword ptr fs:[00000030h]13_2_00FA20DE
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE60B8 mov eax, dword ptr fs:[00000030h]13_2_00FE60B8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE60B8 mov ecx, dword ptr fs:[00000030h]13_2_00FE60B8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F180A0 mov eax, dword ptr fs:[00000030h]13_2_00F180A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB80A8 mov eax, dword ptr fs:[00000030h]13_2_00FB80A8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2208A mov eax, dword ptr fs:[00000030h]13_2_00F2208A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4C073 mov eax, dword ptr fs:[00000030h]13_2_00F4C073
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F22050 mov eax, dword ptr fs:[00000030h]13_2_00F22050
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6050 mov eax, dword ptr fs:[00000030h]13_2_00FA6050
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB6030 mov eax, dword ptr fs:[00000030h]13_2_00FB6030
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1A020 mov eax, dword ptr fs:[00000030h]13_2_00F1A020
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1C020 mov eax, dword ptr fs:[00000030h]13_2_00F1C020
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E016 mov eax, dword ptr fs:[00000030h]13_2_00F3E016
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E016 mov eax, dword ptr fs:[00000030h]13_2_00F3E016
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E016 mov eax, dword ptr fs:[00000030h]13_2_00F3E016
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E016 mov eax, dword ptr fs:[00000030h]13_2_00F3E016
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA4000 mov ecx, dword ptr fs:[00000030h]13_2_00FA4000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC2000 mov eax, dword ptr fs:[00000030h]13_2_00FC2000
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F501F8 mov eax, dword ptr fs:[00000030h]13_2_00F501F8
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF61E5 mov eax, dword ptr fs:[00000030h]13_2_00FF61E5
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E1D0 mov eax, dword ptr fs:[00000030h]13_2_00F9E1D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E1D0 mov eax, dword ptr fs:[00000030h]13_2_00F9E1D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E1D0 mov ecx, dword ptr fs:[00000030h]13_2_00F9E1D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E1D0 mov eax, dword ptr fs:[00000030h]13_2_00F9E1D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E1D0 mov eax, dword ptr fs:[00000030h]13_2_00F9E1D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE61C3 mov eax, dword ptr fs:[00000030h]13_2_00FE61C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE61C3 mov eax, dword ptr fs:[00000030h]13_2_00FE61C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA019F mov eax, dword ptr fs:[00000030h]13_2_00FA019F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA019F mov eax, dword ptr fs:[00000030h]13_2_00FA019F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA019F mov eax, dword ptr fs:[00000030h]13_2_00FA019F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA019F mov eax, dword ptr fs:[00000030h]13_2_00FA019F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1A197 mov eax, dword ptr fs:[00000030h]13_2_00F1A197
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1A197 mov eax, dword ptr fs:[00000030h]13_2_00F1A197
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1A197 mov eax, dword ptr fs:[00000030h]13_2_00F1A197
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F60185 mov eax, dword ptr fs:[00000030h]13_2_00F60185
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDC188 mov eax, dword ptr fs:[00000030h]13_2_00FDC188
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDC188 mov eax, dword ptr fs:[00000030h]13_2_00FDC188
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC4180 mov eax, dword ptr fs:[00000030h]13_2_00FC4180
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC4180 mov eax, dword ptr fs:[00000030h]13_2_00FC4180
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4164 mov eax, dword ptr fs:[00000030h]13_2_00FF4164
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4164 mov eax, dword ptr fs:[00000030h]13_2_00FF4164
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB8158 mov eax, dword ptr fs:[00000030h]13_2_00FB8158
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26154 mov eax, dword ptr fs:[00000030h]13_2_00F26154
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26154 mov eax, dword ptr fs:[00000030h]13_2_00F26154
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1C156 mov eax, dword ptr fs:[00000030h]13_2_00F1C156
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB4144 mov eax, dword ptr fs:[00000030h]13_2_00FB4144
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB4144 mov eax, dword ptr fs:[00000030h]13_2_00FB4144
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB4144 mov ecx, dword ptr fs:[00000030h]13_2_00FB4144
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB4144 mov eax, dword ptr fs:[00000030h]13_2_00FB4144
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB4144 mov eax, dword ptr fs:[00000030h]13_2_00FB4144
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F50124 mov eax, dword ptr fs:[00000030h]13_2_00F50124
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCA118 mov ecx, dword ptr fs:[00000030h]13_2_00FCA118
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCA118 mov eax, dword ptr fs:[00000030h]13_2_00FCA118
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCA118 mov eax, dword ptr fs:[00000030h]13_2_00FCA118
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCA118 mov eax, dword ptr fs:[00000030h]13_2_00FCA118
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE0115 mov eax, dword ptr fs:[00000030h]13_2_00FE0115
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov eax, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov ecx, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov eax, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov eax, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov ecx, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov eax, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov eax, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov ecx, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov eax, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE10E mov ecx, dword ptr fs:[00000030h]13_2_00FCE10E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F302E1 mov eax, dword ptr fs:[00000030h]13_2_00F302E1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F302E1 mov eax, dword ptr fs:[00000030h]13_2_00F302E1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F302E1 mov eax, dword ptr fs:[00000030h]13_2_00F302E1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF62D6 mov eax, dword ptr fs:[00000030h]13_2_00FF62D6
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A2C3 mov eax, dword ptr fs:[00000030h]13_2_00F2A2C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A2C3 mov eax, dword ptr fs:[00000030h]13_2_00F2A2C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A2C3 mov eax, dword ptr fs:[00000030h]13_2_00F2A2C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A2C3 mov eax, dword ptr fs:[00000030h]13_2_00F2A2C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A2C3 mov eax, dword ptr fs:[00000030h]13_2_00F2A2C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB62A0 mov eax, dword ptr fs:[00000030h]13_2_00FB62A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB62A0 mov ecx, dword ptr fs:[00000030h]13_2_00FB62A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB62A0 mov eax, dword ptr fs:[00000030h]13_2_00FB62A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB62A0 mov eax, dword ptr fs:[00000030h]13_2_00FB62A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB62A0 mov eax, dword ptr fs:[00000030h]13_2_00FB62A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB62A0 mov eax, dword ptr fs:[00000030h]13_2_00FB62A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E284 mov eax, dword ptr fs:[00000030h]13_2_00F5E284
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E284 mov eax, dword ptr fs:[00000030h]13_2_00F5E284
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA0283 mov eax, dword ptr fs:[00000030h]13_2_00FA0283
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA0283 mov eax, dword ptr fs:[00000030h]13_2_00FA0283
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA0283 mov eax, dword ptr fs:[00000030h]13_2_00FA0283
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD0274 mov eax, dword ptr fs:[00000030h]13_2_00FD0274
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F24260 mov eax, dword ptr fs:[00000030h]13_2_00F24260
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F24260 mov eax, dword ptr fs:[00000030h]13_2_00F24260
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F24260 mov eax, dword ptr fs:[00000030h]13_2_00F24260
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1826B mov eax, dword ptr fs:[00000030h]13_2_00F1826B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1A250 mov eax, dword ptr fs:[00000030h]13_2_00F1A250
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF625D mov eax, dword ptr fs:[00000030h]13_2_00FF625D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26259 mov eax, dword ptr fs:[00000030h]13_2_00F26259
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDA250 mov eax, dword ptr fs:[00000030h]13_2_00FDA250
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDA250 mov eax, dword ptr fs:[00000030h]13_2_00FDA250
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA8243 mov eax, dword ptr fs:[00000030h]13_2_00FA8243
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA8243 mov ecx, dword ptr fs:[00000030h]13_2_00FA8243
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1823B mov eax, dword ptr fs:[00000030h]13_2_00F1823B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E3F0 mov eax, dword ptr fs:[00000030h]13_2_00F3E3F0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E3F0 mov eax, dword ptr fs:[00000030h]13_2_00F3E3F0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E3F0 mov eax, dword ptr fs:[00000030h]13_2_00F3E3F0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F563FF mov eax, dword ptr fs:[00000030h]13_2_00F563FF
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F303E9 mov eax, dword ptr fs:[00000030h]13_2_00F303E9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE3DB mov eax, dword ptr fs:[00000030h]13_2_00FCE3DB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE3DB mov eax, dword ptr fs:[00000030h]13_2_00FCE3DB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE3DB mov ecx, dword ptr fs:[00000030h]13_2_00FCE3DB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCE3DB mov eax, dword ptr fs:[00000030h]13_2_00FCE3DB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC43D4 mov eax, dword ptr fs:[00000030h]13_2_00FC43D4
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC43D4 mov eax, dword ptr fs:[00000030h]13_2_00FC43D4
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDC3CD mov eax, dword ptr fs:[00000030h]13_2_00FDC3CD
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A3C0 mov eax, dword ptr fs:[00000030h]13_2_00F2A3C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A3C0 mov eax, dword ptr fs:[00000030h]13_2_00F2A3C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A3C0 mov eax, dword ptr fs:[00000030h]13_2_00F2A3C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A3C0 mov eax, dword ptr fs:[00000030h]13_2_00F2A3C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A3C0 mov eax, dword ptr fs:[00000030h]13_2_00F2A3C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A3C0 mov eax, dword ptr fs:[00000030h]13_2_00F2A3C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F283C0 mov eax, dword ptr fs:[00000030h]13_2_00F283C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F283C0 mov eax, dword ptr fs:[00000030h]13_2_00F283C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F283C0 mov eax, dword ptr fs:[00000030h]13_2_00F283C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F283C0 mov eax, dword ptr fs:[00000030h]13_2_00F283C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA63C0 mov eax, dword ptr fs:[00000030h]13_2_00FA63C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F18397 mov eax, dword ptr fs:[00000030h]13_2_00F18397
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F18397 mov eax, dword ptr fs:[00000030h]13_2_00F18397
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F18397 mov eax, dword ptr fs:[00000030h]13_2_00F18397
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1E388 mov eax, dword ptr fs:[00000030h]13_2_00F1E388
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1E388 mov eax, dword ptr fs:[00000030h]13_2_00F1E388
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1E388 mov eax, dword ptr fs:[00000030h]13_2_00F1E388
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4438F mov eax, dword ptr fs:[00000030h]13_2_00F4438F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4438F mov eax, dword ptr fs:[00000030h]13_2_00F4438F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC437C mov eax, dword ptr fs:[00000030h]13_2_00FC437C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA035C mov eax, dword ptr fs:[00000030h]13_2_00FA035C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA035C mov eax, dword ptr fs:[00000030h]13_2_00FA035C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA035C mov eax, dword ptr fs:[00000030h]13_2_00FA035C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA035C mov ecx, dword ptr fs:[00000030h]13_2_00FA035C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA035C mov eax, dword ptr fs:[00000030h]13_2_00FA035C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA035C mov eax, dword ptr fs:[00000030h]13_2_00FA035C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEA352 mov eax, dword ptr fs:[00000030h]13_2_00FEA352
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC8350 mov ecx, dword ptr fs:[00000030h]13_2_00FC8350
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF634F mov eax, dword ptr fs:[00000030h]13_2_00FF634F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA2349 mov eax, dword ptr fs:[00000030h]13_2_00FA2349
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF8324 mov eax, dword ptr fs:[00000030h]13_2_00FF8324
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF8324 mov ecx, dword ptr fs:[00000030h]13_2_00FF8324
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF8324 mov eax, dword ptr fs:[00000030h]13_2_00FF8324
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF8324 mov eax, dword ptr fs:[00000030h]13_2_00FF8324
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1C310 mov ecx, dword ptr fs:[00000030h]13_2_00F1C310
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F40310 mov ecx, dword ptr fs:[00000030h]13_2_00F40310
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A30B mov eax, dword ptr fs:[00000030h]13_2_00F5A30B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A30B mov eax, dword ptr fs:[00000030h]13_2_00F5A30B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A30B mov eax, dword ptr fs:[00000030h]13_2_00F5A30B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F204E5 mov ecx, dword ptr fs:[00000030h]13_2_00F204E5
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F544B0 mov ecx, dword ptr fs:[00000030h]13_2_00F544B0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAA4B0 mov eax, dword ptr fs:[00000030h]13_2_00FAA4B0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F264AB mov eax, dword ptr fs:[00000030h]13_2_00F264AB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDA49A mov eax, dword ptr fs:[00000030h]13_2_00FDA49A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4A470 mov eax, dword ptr fs:[00000030h]13_2_00F4A470
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4A470 mov eax, dword ptr fs:[00000030h]13_2_00F4A470
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4A470 mov eax, dword ptr fs:[00000030h]13_2_00F4A470
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAC460 mov ecx, dword ptr fs:[00000030h]13_2_00FAC460
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FDA456 mov eax, dword ptr fs:[00000030h]13_2_00FDA456
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1645D mov eax, dword ptr fs:[00000030h]13_2_00F1645D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4245A mov eax, dword ptr fs:[00000030h]13_2_00F4245A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E443 mov eax, dword ptr fs:[00000030h]13_2_00F5E443
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A430 mov eax, dword ptr fs:[00000030h]13_2_00F5A430
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1E420 mov eax, dword ptr fs:[00000030h]13_2_00F1E420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1E420 mov eax, dword ptr fs:[00000030h]13_2_00F1E420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1E420 mov eax, dword ptr fs:[00000030h]13_2_00F1E420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1C427 mov eax, dword ptr fs:[00000030h]13_2_00F1C427
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6420 mov eax, dword ptr fs:[00000030h]13_2_00FA6420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6420 mov eax, dword ptr fs:[00000030h]13_2_00FA6420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6420 mov eax, dword ptr fs:[00000030h]13_2_00FA6420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6420 mov eax, dword ptr fs:[00000030h]13_2_00FA6420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6420 mov eax, dword ptr fs:[00000030h]13_2_00FA6420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6420 mov eax, dword ptr fs:[00000030h]13_2_00FA6420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA6420 mov eax, dword ptr fs:[00000030h]13_2_00FA6420
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F58402 mov eax, dword ptr fs:[00000030h]13_2_00F58402
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F58402 mov eax, dword ptr fs:[00000030h]13_2_00F58402
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F58402 mov eax, dword ptr fs:[00000030h]13_2_00F58402
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F225E0 mov eax, dword ptr fs:[00000030h]13_2_00F225E0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E5E7 mov eax, dword ptr fs:[00000030h]13_2_00F4E5E7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C5ED mov eax, dword ptr fs:[00000030h]13_2_00F5C5ED
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C5ED mov eax, dword ptr fs:[00000030h]13_2_00F5C5ED
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F265D0 mov eax, dword ptr fs:[00000030h]13_2_00F265D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A5D0 mov eax, dword ptr fs:[00000030h]13_2_00F5A5D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A5D0 mov eax, dword ptr fs:[00000030h]13_2_00F5A5D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E5CF mov eax, dword ptr fs:[00000030h]13_2_00F5E5CF
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E5CF mov eax, dword ptr fs:[00000030h]13_2_00F5E5CF
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F445B1 mov eax, dword ptr fs:[00000030h]13_2_00F445B1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F445B1 mov eax, dword ptr fs:[00000030h]13_2_00F445B1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA05A7 mov eax, dword ptr fs:[00000030h]13_2_00FA05A7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA05A7 mov eax, dword ptr fs:[00000030h]13_2_00FA05A7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA05A7 mov eax, dword ptr fs:[00000030h]13_2_00FA05A7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5E59C mov eax, dword ptr fs:[00000030h]13_2_00F5E59C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F22582 mov eax, dword ptr fs:[00000030h]13_2_00F22582
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F22582 mov ecx, dword ptr fs:[00000030h]13_2_00F22582
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F54588 mov eax, dword ptr fs:[00000030h]13_2_00F54588
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5656A mov eax, dword ptr fs:[00000030h]13_2_00F5656A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5656A mov eax, dword ptr fs:[00000030h]13_2_00F5656A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5656A mov eax, dword ptr fs:[00000030h]13_2_00F5656A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28550 mov eax, dword ptr fs:[00000030h]13_2_00F28550
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28550 mov eax, dword ptr fs:[00000030h]13_2_00F28550
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30535 mov eax, dword ptr fs:[00000030h]13_2_00F30535
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30535 mov eax, dword ptr fs:[00000030h]13_2_00F30535
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30535 mov eax, dword ptr fs:[00000030h]13_2_00F30535
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30535 mov eax, dword ptr fs:[00000030h]13_2_00F30535
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30535 mov eax, dword ptr fs:[00000030h]13_2_00F30535
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30535 mov eax, dword ptr fs:[00000030h]13_2_00F30535
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E53E mov eax, dword ptr fs:[00000030h]13_2_00F4E53E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E53E mov eax, dword ptr fs:[00000030h]13_2_00F4E53E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E53E mov eax, dword ptr fs:[00000030h]13_2_00F4E53E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E53E mov eax, dword ptr fs:[00000030h]13_2_00F4E53E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E53E mov eax, dword ptr fs:[00000030h]13_2_00F4E53E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB6500 mov eax, dword ptr fs:[00000030h]13_2_00FB6500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4500 mov eax, dword ptr fs:[00000030h]13_2_00FF4500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4500 mov eax, dword ptr fs:[00000030h]13_2_00FF4500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4500 mov eax, dword ptr fs:[00000030h]13_2_00FF4500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4500 mov eax, dword ptr fs:[00000030h]13_2_00FF4500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4500 mov eax, dword ptr fs:[00000030h]13_2_00FF4500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4500 mov eax, dword ptr fs:[00000030h]13_2_00FF4500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4500 mov eax, dword ptr fs:[00000030h]13_2_00FF4500
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E6F2 mov eax, dword ptr fs:[00000030h]13_2_00F9E6F2
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E6F2 mov eax, dword ptr fs:[00000030h]13_2_00F9E6F2
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E6F2 mov eax, dword ptr fs:[00000030h]13_2_00F9E6F2
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E6F2 mov eax, dword ptr fs:[00000030h]13_2_00F9E6F2
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA06F1 mov eax, dword ptr fs:[00000030h]13_2_00FA06F1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA06F1 mov eax, dword ptr fs:[00000030h]13_2_00FA06F1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A6C7 mov ebx, dword ptr fs:[00000030h]13_2_00F5A6C7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A6C7 mov eax, dword ptr fs:[00000030h]13_2_00F5A6C7
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F566B0 mov eax, dword ptr fs:[00000030h]13_2_00F566B0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C6A6 mov eax, dword ptr fs:[00000030h]13_2_00F5C6A6
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F24690 mov eax, dword ptr fs:[00000030h]13_2_00F24690
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F24690 mov eax, dword ptr fs:[00000030h]13_2_00F24690
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F52674 mov eax, dword ptr fs:[00000030h]13_2_00F52674
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE866E mov eax, dword ptr fs:[00000030h]13_2_00FE866E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE866E mov eax, dword ptr fs:[00000030h]13_2_00FE866E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A660 mov eax, dword ptr fs:[00000030h]13_2_00F5A660
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A660 mov eax, dword ptr fs:[00000030h]13_2_00F5A660
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3C640 mov eax, dword ptr fs:[00000030h]13_2_00F3C640
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3E627 mov eax, dword ptr fs:[00000030h]13_2_00F3E627
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F56620 mov eax, dword ptr fs:[00000030h]13_2_00F56620
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F58620 mov eax, dword ptr fs:[00000030h]13_2_00F58620
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2262C mov eax, dword ptr fs:[00000030h]13_2_00F2262C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62619 mov eax, dword ptr fs:[00000030h]13_2_00F62619
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E609 mov eax, dword ptr fs:[00000030h]13_2_00F9E609
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3260B mov eax, dword ptr fs:[00000030h]13_2_00F3260B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3260B mov eax, dword ptr fs:[00000030h]13_2_00F3260B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3260B mov eax, dword ptr fs:[00000030h]13_2_00F3260B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3260B mov eax, dword ptr fs:[00000030h]13_2_00F3260B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3260B mov eax, dword ptr fs:[00000030h]13_2_00F3260B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3260B mov eax, dword ptr fs:[00000030h]13_2_00F3260B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F3260B mov eax, dword ptr fs:[00000030h]13_2_00F3260B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F247FB mov eax, dword ptr fs:[00000030h]13_2_00F247FB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F247FB mov eax, dword ptr fs:[00000030h]13_2_00F247FB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F427ED mov eax, dword ptr fs:[00000030h]13_2_00F427ED
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F427ED mov eax, dword ptr fs:[00000030h]13_2_00F427ED
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F427ED mov eax, dword ptr fs:[00000030h]13_2_00F427ED
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAE7E1 mov eax, dword ptr fs:[00000030h]13_2_00FAE7E1
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2C7C0 mov eax, dword ptr fs:[00000030h]13_2_00F2C7C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA07C3 mov eax, dword ptr fs:[00000030h]13_2_00FA07C3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F207AF mov eax, dword ptr fs:[00000030h]13_2_00F207AF
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD47A0 mov eax, dword ptr fs:[00000030h]13_2_00FD47A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC678E mov eax, dword ptr fs:[00000030h]13_2_00FC678E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28770 mov eax, dword ptr fs:[00000030h]13_2_00F28770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30770 mov eax, dword ptr fs:[00000030h]13_2_00F30770
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20750 mov eax, dword ptr fs:[00000030h]13_2_00F20750
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62750 mov eax, dword ptr fs:[00000030h]13_2_00F62750
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F62750 mov eax, dword ptr fs:[00000030h]13_2_00F62750
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAE75D mov eax, dword ptr fs:[00000030h]13_2_00FAE75D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA4755 mov eax, dword ptr fs:[00000030h]13_2_00FA4755
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5674D mov esi, dword ptr fs:[00000030h]13_2_00F5674D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5674D mov eax, dword ptr fs:[00000030h]13_2_00F5674D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5674D mov eax, dword ptr fs:[00000030h]13_2_00F5674D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5273C mov eax, dword ptr fs:[00000030h]13_2_00F5273C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5273C mov ecx, dword ptr fs:[00000030h]13_2_00F5273C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5273C mov eax, dword ptr fs:[00000030h]13_2_00F5273C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9C730 mov eax, dword ptr fs:[00000030h]13_2_00F9C730
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C720 mov eax, dword ptr fs:[00000030h]13_2_00F5C720
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C720 mov eax, dword ptr fs:[00000030h]13_2_00F5C720
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20710 mov eax, dword ptr fs:[00000030h]13_2_00F20710
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F50710 mov eax, dword ptr fs:[00000030h]13_2_00F50710
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C700 mov eax, dword ptr fs:[00000030h]13_2_00F5C700
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C8F9 mov eax, dword ptr fs:[00000030h]13_2_00F5C8F9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5C8F9 mov eax, dword ptr fs:[00000030h]13_2_00F5C8F9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEA8E4 mov eax, dword ptr fs:[00000030h]13_2_00FEA8E4
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4E8C0 mov eax, dword ptr fs:[00000030h]13_2_00F4E8C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF08C0 mov eax, dword ptr fs:[00000030h]13_2_00FF08C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAC89D mov eax, dword ptr fs:[00000030h]13_2_00FAC89D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20887 mov eax, dword ptr fs:[00000030h]13_2_00F20887
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAE872 mov eax, dword ptr fs:[00000030h]13_2_00FAE872
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAE872 mov eax, dword ptr fs:[00000030h]13_2_00FAE872
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB6870 mov eax, dword ptr fs:[00000030h]13_2_00FB6870
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB6870 mov eax, dword ptr fs:[00000030h]13_2_00FB6870
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F50854 mov eax, dword ptr fs:[00000030h]13_2_00F50854
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F24859 mov eax, dword ptr fs:[00000030h]13_2_00F24859
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F24859 mov eax, dword ptr fs:[00000030h]13_2_00F24859
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F32840 mov ecx, dword ptr fs:[00000030h]13_2_00F32840
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F42835 mov eax, dword ptr fs:[00000030h]13_2_00F42835
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F42835 mov eax, dword ptr fs:[00000030h]13_2_00F42835
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F42835 mov eax, dword ptr fs:[00000030h]13_2_00F42835
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F42835 mov ecx, dword ptr fs:[00000030h]13_2_00F42835
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F42835 mov eax, dword ptr fs:[00000030h]13_2_00F42835
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F42835 mov eax, dword ptr fs:[00000030h]13_2_00F42835
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5A830 mov eax, dword ptr fs:[00000030h]13_2_00F5A830
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC483A mov eax, dword ptr fs:[00000030h]13_2_00FC483A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC483A mov eax, dword ptr fs:[00000030h]13_2_00FC483A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAC810 mov eax, dword ptr fs:[00000030h]13_2_00FAC810
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F529F9 mov eax, dword ptr fs:[00000030h]13_2_00F529F9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F529F9 mov eax, dword ptr fs:[00000030h]13_2_00F529F9
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAE9E0 mov eax, dword ptr fs:[00000030h]13_2_00FAE9E0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A9D0 mov eax, dword ptr fs:[00000030h]13_2_00F2A9D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A9D0 mov eax, dword ptr fs:[00000030h]13_2_00F2A9D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A9D0 mov eax, dword ptr fs:[00000030h]13_2_00F2A9D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A9D0 mov eax, dword ptr fs:[00000030h]13_2_00F2A9D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A9D0 mov eax, dword ptr fs:[00000030h]13_2_00F2A9D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2A9D0 mov eax, dword ptr fs:[00000030h]13_2_00F2A9D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F549D0 mov eax, dword ptr fs:[00000030h]13_2_00F549D0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEA9D3 mov eax, dword ptr fs:[00000030h]13_2_00FEA9D3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB69C0 mov eax, dword ptr fs:[00000030h]13_2_00FB69C0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA89B3 mov esi, dword ptr fs:[00000030h]13_2_00FA89B3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA89B3 mov eax, dword ptr fs:[00000030h]13_2_00FA89B3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA89B3 mov eax, dword ptr fs:[00000030h]13_2_00FA89B3
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F329A0 mov eax, dword ptr fs:[00000030h]13_2_00F329A0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F209AD mov eax, dword ptr fs:[00000030h]13_2_00F209AD
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F209AD mov eax, dword ptr fs:[00000030h]13_2_00F209AD
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC4978 mov eax, dword ptr fs:[00000030h]13_2_00FC4978
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC4978 mov eax, dword ptr fs:[00000030h]13_2_00FC4978
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAC97C mov eax, dword ptr fs:[00000030h]13_2_00FAC97C
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F46962 mov eax, dword ptr fs:[00000030h]13_2_00F46962
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F46962 mov eax, dword ptr fs:[00000030h]13_2_00F46962
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F46962 mov eax, dword ptr fs:[00000030h]13_2_00F46962
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F6096E mov eax, dword ptr fs:[00000030h]13_2_00F6096E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F6096E mov edx, dword ptr fs:[00000030h]13_2_00F6096E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F6096E mov eax, dword ptr fs:[00000030h]13_2_00F6096E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA0946 mov eax, dword ptr fs:[00000030h]13_2_00FA0946
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4940 mov eax, dword ptr fs:[00000030h]13_2_00FF4940
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FA892A mov eax, dword ptr fs:[00000030h]13_2_00FA892A
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB892B mov eax, dword ptr fs:[00000030h]13_2_00FB892B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FAC912 mov eax, dword ptr fs:[00000030h]13_2_00FAC912
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F18918 mov eax, dword ptr fs:[00000030h]13_2_00F18918
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F18918 mov eax, dword ptr fs:[00000030h]13_2_00F18918
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E908 mov eax, dword ptr fs:[00000030h]13_2_00F9E908
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9E908 mov eax, dword ptr fs:[00000030h]13_2_00F9E908
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5AAEE mov eax, dword ptr fs:[00000030h]13_2_00F5AAEE
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5AAEE mov eax, dword ptr fs:[00000030h]13_2_00F5AAEE
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20AD0 mov eax, dword ptr fs:[00000030h]13_2_00F20AD0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F54AD0 mov eax, dword ptr fs:[00000030h]13_2_00F54AD0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F54AD0 mov eax, dword ptr fs:[00000030h]13_2_00F54AD0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F76ACC mov eax, dword ptr fs:[00000030h]13_2_00F76ACC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F76ACC mov eax, dword ptr fs:[00000030h]13_2_00F76ACC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F76ACC mov eax, dword ptr fs:[00000030h]13_2_00F76ACC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28AA0 mov eax, dword ptr fs:[00000030h]13_2_00F28AA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28AA0 mov eax, dword ptr fs:[00000030h]13_2_00F28AA0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F76AA4 mov eax, dword ptr fs:[00000030h]13_2_00F76AA4
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F58A90 mov edx, dword ptr fs:[00000030h]13_2_00F58A90
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F2EA80 mov eax, dword ptr fs:[00000030h]13_2_00F2EA80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF4A80 mov eax, dword ptr fs:[00000030h]13_2_00FF4A80
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9CA72 mov eax, dword ptr fs:[00000030h]13_2_00F9CA72
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9CA72 mov eax, dword ptr fs:[00000030h]13_2_00F9CA72
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5CA6F mov eax, dword ptr fs:[00000030h]13_2_00F5CA6F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5CA6F mov eax, dword ptr fs:[00000030h]13_2_00F5CA6F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5CA6F mov eax, dword ptr fs:[00000030h]13_2_00F5CA6F
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCEA60 mov eax, dword ptr fs:[00000030h]13_2_00FCEA60
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26A50 mov eax, dword ptr fs:[00000030h]13_2_00F26A50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26A50 mov eax, dword ptr fs:[00000030h]13_2_00F26A50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26A50 mov eax, dword ptr fs:[00000030h]13_2_00F26A50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26A50 mov eax, dword ptr fs:[00000030h]13_2_00F26A50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26A50 mov eax, dword ptr fs:[00000030h]13_2_00F26A50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26A50 mov eax, dword ptr fs:[00000030h]13_2_00F26A50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F26A50 mov eax, dword ptr fs:[00000030h]13_2_00F26A50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30A5B mov eax, dword ptr fs:[00000030h]13_2_00F30A5B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30A5B mov eax, dword ptr fs:[00000030h]13_2_00F30A5B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F44A35 mov eax, dword ptr fs:[00000030h]13_2_00F44A35
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F44A35 mov eax, dword ptr fs:[00000030h]13_2_00F44A35
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5CA38 mov eax, dword ptr fs:[00000030h]13_2_00F5CA38
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F5CA24 mov eax, dword ptr fs:[00000030h]13_2_00F5CA24
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4EA2E mov eax, dword ptr fs:[00000030h]13_2_00F4EA2E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FACA11 mov eax, dword ptr fs:[00000030h]13_2_00FACA11
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28BF0 mov eax, dword ptr fs:[00000030h]13_2_00F28BF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28BF0 mov eax, dword ptr fs:[00000030h]13_2_00F28BF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F28BF0 mov eax, dword ptr fs:[00000030h]13_2_00F28BF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4EBFC mov eax, dword ptr fs:[00000030h]13_2_00F4EBFC
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FACBF0 mov eax, dword ptr fs:[00000030h]13_2_00FACBF0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCEBD0 mov eax, dword ptr fs:[00000030h]13_2_00FCEBD0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F40BCB mov eax, dword ptr fs:[00000030h]13_2_00F40BCB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F40BCB mov eax, dword ptr fs:[00000030h]13_2_00F40BCB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F40BCB mov eax, dword ptr fs:[00000030h]13_2_00F40BCB
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20BCD mov eax, dword ptr fs:[00000030h]13_2_00F20BCD
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20BCD mov eax, dword ptr fs:[00000030h]13_2_00F20BCD
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F20BCD mov eax, dword ptr fs:[00000030h]13_2_00F20BCD
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30BBE mov eax, dword ptr fs:[00000030h]13_2_00F30BBE
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F30BBE mov eax, dword ptr fs:[00000030h]13_2_00F30BBE
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD4BB0 mov eax, dword ptr fs:[00000030h]13_2_00FD4BB0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD4BB0 mov eax, dword ptr fs:[00000030h]13_2_00FD4BB0
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F1CB7E mov eax, dword ptr fs:[00000030h]13_2_00F1CB7E
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F18B50 mov eax, dword ptr fs:[00000030h]13_2_00F18B50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF2B57 mov eax, dword ptr fs:[00000030h]13_2_00FF2B57
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF2B57 mov eax, dword ptr fs:[00000030h]13_2_00FF2B57
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF2B57 mov eax, dword ptr fs:[00000030h]13_2_00FF2B57
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FF2B57 mov eax, dword ptr fs:[00000030h]13_2_00FF2B57
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FCEB50 mov eax, dword ptr fs:[00000030h]13_2_00FCEB50
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD4B4B mov eax, dword ptr fs:[00000030h]13_2_00FD4B4B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FD4B4B mov eax, dword ptr fs:[00000030h]13_2_00FD4B4B
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB6B40 mov eax, dword ptr fs:[00000030h]13_2_00FB6B40
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FB6B40 mov eax, dword ptr fs:[00000030h]13_2_00FB6B40
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FEAB40 mov eax, dword ptr fs:[00000030h]13_2_00FEAB40
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FC8B42 mov eax, dword ptr fs:[00000030h]13_2_00FC8B42
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4EB20 mov eax, dword ptr fs:[00000030h]13_2_00F4EB20
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F4EB20 mov eax, dword ptr fs:[00000030h]13_2_00F4EB20
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE8B28 mov eax, dword ptr fs:[00000030h]13_2_00FE8B28
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00FE8B28 mov eax, dword ptr fs:[00000030h]13_2_00FE8B28
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeCode function: 13_2_00F9EB1D mov eax, dword ptr fs:[00000030h]13_2_00F9EB1D
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Adds a directory exclusion to Windows Defender
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"Jump to behavior
            Injects a PE file into a foreign processes
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeMemory written: C:\Users\user\Desktop\Payment TT Copy.PDF.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeMemory written: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeProcess created: C:\Users\user\Desktop\Payment TT Copy.PDF.exe "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeProcess created: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"Jump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeQueries volume information: C:\Users\user\Desktop\Payment TT Copy.PDF.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeQueries volume information: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\VajtonZVfAG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\Payment TT Copy.PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 13.2.Payment TT Copy.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
            Scheduled Task/Job            		1
            Scheduled Task/Job            		111
            Process Injection            		11
            Masquerading            		OS Credential Dumping121
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/Job1
            DLL Side-Loading            		1
            Scheduled Task/Job            		11
            Disable or Modify Tools            		LSASS Memory1
            Process Discovery            		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		41
            Virtualization/Sandbox Evasion            		Security Account Manager41
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook111
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets1
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts13
            Obfuscated Files or Information            		Cached Domain Credentials12
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
            Software Packing            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Timestomp            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            DLL Side-Loading            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1519410 Sample: Payment TT Copy.PDF.exe Startdate: 26/09/2024 Architecture: WINDOWS Score: 100 46 Malicious sample detected (through community Yara rule) 2->46 48 Sigma detected: Scheduled temp file as task from temp location 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 11 other signatures 2->52 7 Payment TT Copy.PDF.exe 7 2->7         started        11 VajtonZVfAG.exe 5 2->11         started        process3 file4 38 C:\Users\user\AppData\...\VajtonZVfAG.exe, PE32 7->38 dropped 40 C:\Users\...\VajtonZVfAG.exe:Zone.Identifier, ASCII 7->40 dropped 42 C:\Users\user\AppData\Local\...\tmp78CA.tmp, XML 7->42 dropped 44 C:\Users\user\...\Payment TT Copy.PDF.exe.log, ASCII 7->44 dropped 54 Adds a directory exclusion to Windows Defender 7->54 56 Injects a PE file into a foreign processes 7->56 13 powershell.exe 23 7->13         started        16 powershell.exe 23 7->16         started        18 schtasks.exe 1 7->18         started        26 6 other processes 7->26 58 Multi AV Scanner detection for dropped file 11->58 60 Machine Learning detection for dropped file 11->60 20 schtasks.exe 1 11->20         started        22 VajtonZVfAG.exe 11->22         started        24 VajtonZVfAG.exe 11->24         started        signatures5 process6 signatures7 62 Loading BitLocker PowerShell Module 13->62 28 WmiPrvSE.exe 13->28         started        30 conhost.exe 13->30         started        32 conhost.exe 16->32         started        34 conhost.exe 18->34         started        36 conhost.exe 20->36         started        process8

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Payment TT Copy.PDF.exe26%ReversingLabs
            Payment TT Copy.PDF.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Roaming\VajtonZVfAG.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Roaming\VajtonZVfAG.exe26%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
            https://www.chiark.greenend.org.uk/~sgtatham/putty/00%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namePayment TT Copy.PDF.exe, 00000000.00000002.2127687121.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, VajtonZVfAG.exe, 0000000E.00000002.2177704253.0000000002E99000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://www.chiark.greenend.org.uk/~sgtatham/putty/0Payment TT Copy.PDF.exe, VajtonZVfAG.exe.0.drfalse
            • Avira URL Cloud: safe
            		unknown

            World Map of Contacted IPs

            ⊘No contacted IP infos

            General Information

            Joe Sandbox version:41.0.0 Charoite
            Analysis ID:1519410
            Start date and time:2024-09-26 13:49:06 +02:00
            Joe Sandbox product:CloudBasic
            Overall analysis duration:0h 8m 37s
            Hypervisor based Inspection enabled:false
            Report type:full
            Cookbook file name:default.jbs
            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
            Number of analysed new started processes analysed:25
            Number of new started drivers analysed:0
            Number of existing processes analysed:0
            Number of existing drivers analysed:0
            Number of injected processes analysed:0
            Technologies:
            • HCA enabled
            • EGA enabled
            • AMSI enabled
            Analysis Mode:default
            Analysis stop reason:Timeout
            Sample name:Payment TT Copy.PDF.exe
            Detection:MAL
            Classification:mal100.troj.evad.winEXE@30/15@0/0
            EGA Information:
            • Successful, ratio: 100%
            HCA Information:
            • Successful, ratio: 99%
            • Number of executed functions: 84
            • Number of non-executed functions: 298
            Cookbook Comments:
            • Found application associated with file extension: .exe

            Warnings

            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
            • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
            • Not all processes where analyzed, report is missing behavior information
            • Report size exceeded maximum capacity and may have missing behavior information.
            • Report size getting too big, too many NtCreateKey calls found.
            • Report size getting too big, too many NtOpenKeyEx calls found.
            • Report size getting too big, too many NtProtectVirtualMemory calls found.
            • Report size getting too big, too many NtQueryValueKey calls found.
            • VT rate limit hit for: Payment TT Copy.PDF.exe

            Simulations

            Behavior and APIs

            TimeTypeDescription
            07:49:54API Interceptor5x Sleep call for process: Payment TT Copy.PDF.exe modified
            07:49:56API Interceptor42x Sleep call for process: powershell.exe modified
            07:50:00API Interceptor5x Sleep call for process: VajtonZVfAG.exe modified
            13:49:57Task SchedulerRun new task: VajtonZVfAG path: C:\Users\user\AppData\Roaming\VajtonZVfAG.exe

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment TT Copy.PDF.exe.log

            Download File
            Process:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):1216
            Entropy (8bit):5.34331486778365
            Encrypted:false
            SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
            MD5:1330C80CAAC9A0FB172F202485E9B1E8
            SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
            SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
            SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
            Malicious:true
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VajtonZVfAG.exe.log

            Download File
            Process:C:\Users\user\AppData\Roaming\VajtonZVfAG.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):1216
            Entropy (8bit):5.34331486778365
            Encrypted:false
            SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
            MD5:1330C80CAAC9A0FB172F202485E9B1E8
            SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
            SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
            SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
            Malicious:false
            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:data
            Category:dropped
            Size (bytes):2232
            Entropy (8bit):5.379552885213346
            Encrypted:false
            SSDEEP:48:fWSU4xympjgs4RIoU99tK8NPZHUl7u1iMugeC/ZM0Uyus:fLHxvCsIfA2KRHmOugw1s
            MD5:3E5712DC6AFCA8CF60C5CB8BE65E2089
            SHA1:CDBAF3935912EFB05DBE58CA89C5422F07B528A0
            SHA-256:B9F7E5F0AFD718D8585A8B37DD8C459ECDD4E7E68C5FE61631D89CDD3E229833
            SHA-512:1BD81033EB26CD0EE3DEF6F02FECB4097D878D61CAA5BEF6739C51E889B99C9E695BECF51719959D33F7BA9838E202ADD7EE4DD704D5163B584F4E8B8B7ECC38
            Malicious:false
            Preview:@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2yu0mvov.uxz.psm1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_40iq5yxn.xbt.ps1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_menbhpka.bhk.psm1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkuzewzp.b5d.ps1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uaeimfvc.pa0.psm1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ue55vztt.5ib.psm1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfo1lbrm.54f.ps1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zbkfjvgu.fsm.ps1

            Download File
            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):60
            Entropy (8bit):4.038920595031593
            Encrypted:false
            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
            MD5:D17FE0A3F47BE24A6453E9EF58C94641
            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
            Malicious:false
            Preview:# PowerShell test file to determine AppLocker lockdown mode

            C:\Users\user\AppData\Local\Temp\tmp78CA.tmp

            Download File
            Process:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            File Type:XML 1.0 document, ASCII text
            Category:dropped
            Size (bytes):1598
            Entropy (8bit):5.101916476784669
            Encrypted:false
            SSDEEP:24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLWxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTOv
            MD5:7F15481CC9759CAA240D53FD968653C2
            SHA1:DC58A4D09C98EF2A1DDA765E187146FFF9646883
            SHA-256:A35C6ADC31773BF3FB47B15E39C1A9B7E4E5300B79782472E69F6220A8E2C42B
            SHA-512:863DE34C13FD24D94855947132F013ECFB939CCB7E3E462C3C14ADEB8C3D59663C832F6DD4487EC327156A3DA33662592F74DBAD3DFA76F369719B631FB1E24F
            Malicious:true
            Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

            C:\Users\user\AppData\Local\Temp\tmp91A1.tmp

            Download File
            Process:C:\Users\user\AppData\Roaming\VajtonZVfAG.exe
            File Type:XML 1.0 document, ASCII text
            Category:dropped
            Size (bytes):1598
            Entropy (8bit):5.101916476784669
            Encrypted:false
            SSDEEP:24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLWxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTOv
            MD5:7F15481CC9759CAA240D53FD968653C2
            SHA1:DC58A4D09C98EF2A1DDA765E187146FFF9646883
            SHA-256:A35C6ADC31773BF3FB47B15E39C1A9B7E4E5300B79782472E69F6220A8E2C42B
            SHA-512:863DE34C13FD24D94855947132F013ECFB939CCB7E3E462C3C14ADEB8C3D59663C832F6DD4487EC327156A3DA33662592F74DBAD3DFA76F369719B631FB1E24F
            Malicious:false
            Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

            C:\Users\user\AppData\Roaming\VajtonZVfAG.exe

            Download File
            Process:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Category:dropped
            Size (bytes):730632
            Entropy (8bit):7.836147361019564
            Encrypted:false
            SSDEEP:12288:GLn5rgwI8n++Ta+CHouivf3ilYWObQPw0f5m8ce0tPPiT6IS8bQbpkR:GqwI8nvT2IuGfJ9XjeWiT/I0
            MD5:25E0C13B707F3EBCE3F35E806AC547D7
            SHA1:647C3A60022EAA64B8D43C92834F0D040F305CCF
            SHA-256:1A375DD13598CD93E502E68F84236B536B9333FC9F1F2DB88F2BBBBC67DD04C4
            SHA-512:013239CB462B87DBFC22D06E85F3D5DAA7F6999C1A12CA5CA66D07ACAE12FA92F80BF31BE7F6FE09658A39E1AB1AABA7EA6ADA50A17AA35C0655A46DC6D2803D
            Malicious:true
            Antivirus:
            • Antivirus: Joe Sandbox ML, Detection: 100%
            • Antivirus: ReversingLabs, Detection: 26%
            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._...............0.................. ... ....@.. .......................`............@.................................`...O.... ...................6...@......H...p............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......tS..lE..............hR...........................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(.....*.0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}.....*...0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

            C:\Users\user\AppData\Roaming\VajtonZVfAG.exe:Zone.Identifier

            Download File
            Process:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            File Type:ASCII text, with CRLF line terminators
            Category:dropped
            Size (bytes):26
            Entropy (8bit):3.95006375643621
            Encrypted:false
            SSDEEP:3:ggPYV:rPYV
            MD5:187F488E27DB4AF347237FE461A079AD
            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
            Malicious:true
            Preview:[ZoneTransfer]....ZoneId=0

            Static File Info

            General

            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
            Entropy (8bit):7.836147361019564
            TrID:
            • Win32 Executable (generic) Net Framework (10011505/4) 49.98%
            • Win32 Executable (generic) a (10002005/4) 49.93%
            • Windows Screen Saver (13104/52) 0.07%
            • Generic Win/DOS Executable (2004/3) 0.01%
            • DOS Executable Generic (2002/1) 0.01%
            File name:Payment TT Copy.PDF.exe
            File size:730'632 bytes
            MD5:25e0c13b707f3ebce3f35e806ac547d7
            SHA1:647c3a60022eaa64b8d43c92834f0d040f305ccf
            SHA256:1a375dd13598cd93e502e68f84236b536b9333fc9f1f2db88f2bbbbc67dd04c4
            SHA512:013239cb462b87dbfc22d06e85f3d5daa7f6999c1a12ca5ca66d07acae12fa92f80bf31be7f6fe09658a39e1ab1aaba7ea6ada50a17aa35c0655a46dc6d2803d
            SSDEEP:12288:GLn5rgwI8n++Ta+CHouivf3ilYWObQPw0f5m8ce0tPPiT6IS8bQbpkR:GqwI8nvT2IuGfJ9XjeWiT/I0
            TLSH:3EF412402152EA05E9921F740572D1F46779BE89A911C30BEFEABEEF7CBA3819941343
            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._...............0.................. ... ....@.. .......................`............@................................

            File Icon

            Icon Hash:00928e8e8686b000

            Static PE Info

            General

            Entrypoint:0x4b04b2
            Entrypoint Section:.text
            Digitally signed:true
            Imagebase:0x400000
            Subsystem:windows gui
            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Time Stamp:0xA55FACED [Sun Dec 2 09:27:09 2057 UTC]
            TLS Callbacks:
            CLR (.Net) Version:
            OS Version Major:4
            OS Version Minor:0
            File Version Major:4
            File Version Minor:0
            Subsystem Version Major:4
            Subsystem Version Minor:0
            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

            Authenticode Signature

            Signature Valid:false
            Signature Issuer:CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
            Signature Validation Error:The digital signature of the object did not verify
            Error Number:-2146869232
            Not Before, Not After
            • 13/11/2018 01:00:00 09/11/2021 00:59:59
            Subject Chain
            • CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
            Version:3
            Thumbprint MD5:DABD77E44EF6B3BB91740FA46696B779
            Thumbprint SHA-1:5B9E273CF11941FD8C6BE3F038C4797BBE884268
            Thumbprint SHA-256:4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
            Serial:7C1118CBBADC95DA3752C46E47A27438

            Entrypoint Preview

            Instruction
            jmp dword ptr [00402000h]
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al
            add byte ptr [eax], al

            Data Directories

            NameVirtual AddressVirtual Size Is in Section
            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IMPORT0xb04600x4f.text
            IMAGE_DIRECTORY_ENTRY_RESOURCE0xb20000x5b4.rsrc
            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
            IMAGE_DIRECTORY_ENTRY_SECURITY0xaf0000x3608
            IMAGE_DIRECTORY_ENTRY_BASERELOC0xb40000xc.reloc
            IMAGE_DIRECTORY_ENTRY_DEBUG0xaeb480x70.text
            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

            Sections

            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
            .text0x20000xae4b80xae600ba8d57ec4973fe1603d209d6cff0e57fFalse0.9316658266129032OpenPGP Secret Key7.841420186356563IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            .rsrc0xb20000x5b40x600d9bb5a338729011848bd3d6a64523dd2False0.421875data4.086513041250264IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
            .reloc0xb40000xc0x20053b138fd1f66d7dbf195c57f660022b3False0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

            Resources

            NameRVASizeTypeLanguageCountryZLIB Complexity
            RT_VERSION0xb20900x324data0.43283582089552236
            RT_MANIFEST0xb23c40x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

            Imports

            DLLImport
            mscoree.dll_CorExeMain

            Network Behavior

            ⊘No network behavior found

            Statistics

            CPU Usage

            Click to jump to process

            Memory Usage

            Click to jump to process

            High Level Behavior Distribution

            Click to dive into process behavior distribution

            Behavior

            Click to jump to process

            System Behavior

            General

            Target ID:0
            Start time:07:49:54
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            Wow64 process (32bit):true
            Commandline:"C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Imagebase:0xaf0000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:3
            Start time:07:49:55
            Start date:26/09/2024
            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            Wow64 process (32bit):true
            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Imagebase:0xd20000
            File size:433'152 bytes
            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:4
            Start time:07:49:55
            Start date:26/09/2024
            Path:C:\Windows\System32\conhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Imagebase:0x7ff66e660000
            File size:862'208 bytes
            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:5
            Start time:07:49:55
            Start date:26/09/2024
            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            Wow64 process (32bit):true
            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"
            Imagebase:0xd20000
            File size:433'152 bytes
            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:6
            Start time:07:49:55
            Start date:26/09/2024
            Path:C:\Windows\System32\conhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Imagebase:0x7ff66e660000
            File size:862'208 bytes
            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:7
            Start time:07:49:55
            Start date:26/09/2024
            Path:C:\Windows\SysWOW64\schtasks.exe
            Wow64 process (32bit):true
            Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp78CA.tmp"
            Imagebase:0x260000
            File size:187'904 bytes
            MD5 hash:48C2FE20575769DE916F48EF0676A965
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:8
            Start time:07:49:55
            Start date:26/09/2024
            Path:C:\Windows\System32\conhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Imagebase:0x7ff66e660000
            File size:862'208 bytes
            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:9
            Start time:07:49:56
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            Wow64 process (32bit):false
            Commandline:"C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Imagebase:0x2d0000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:10
            Start time:07:49:56
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            Wow64 process (32bit):false
            Commandline:"C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Imagebase:0x10000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:11
            Start time:07:49:56
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            Wow64 process (32bit):false
            Commandline:"C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Imagebase:0x100000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:12
            Start time:07:49:56
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            Wow64 process (32bit):false
            Commandline:"C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Imagebase:0x2d0000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:13
            Start time:07:49:56
            Start date:26/09/2024
            Path:C:\Users\user\Desktop\Payment TT Copy.PDF.exe
            Wow64 process (32bit):true
            Commandline:"C:\Users\user\Desktop\Payment TT Copy.PDF.exe"
            Imagebase:0x470000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:true
            Has administrator privileges:true
            Programmed in:C, C++ or other language
            Yara matches:
            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.2166748571.0000000000BD0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
            Reputation:low
            Has exited:true

            General

            Target ID:14
            Start time:07:49:57
            Start date:26/09/2024
            Path:C:\Users\user\AppData\Roaming\VajtonZVfAG.exe
            Wow64 process (32bit):true
            Commandline:C:\Users\user\AppData\Roaming\VajtonZVfAG.exe
            Imagebase:0x9b0000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:false
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Antivirus matches:
            • Detection: 100%, Joe Sandbox ML
            • Detection: 26%, ReversingLabs
            Reputation:low
            Has exited:true

            General

            Target ID:15
            Start time:07:49:59
            Start date:26/09/2024
            Path:C:\Windows\System32\wbem\WmiPrvSE.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            Imagebase:0x7ff717f30000
            File size:496'640 bytes
            MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
            Has elevated privileges:true
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:16
            Start time:07:50:01
            Start date:26/09/2024
            Path:C:\Windows\SysWOW64\schtasks.exe
            Wow64 process (32bit):true
            Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VajtonZVfAG" /XML "C:\Users\user\AppData\Local\Temp\tmp91A1.tmp"
            Imagebase:0x260000
            File size:187'904 bytes
            MD5 hash:48C2FE20575769DE916F48EF0676A965
            Has elevated privileges:false
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:17
            Start time:07:50:02
            Start date:26/09/2024
            Path:C:\Windows\System32\conhost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Imagebase:0x7ff66e660000
            File size:862'208 bytes
            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
            Has elevated privileges:false
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Reputation:high
            Has exited:true

            General

            Target ID:18
            Start time:07:50:02
            Start date:26/09/2024
            Path:C:\Users\user\AppData\Roaming\VajtonZVfAG.exe
            Wow64 process (32bit):false
            Commandline:"C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"
            Imagebase:0x10000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:false
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:19
            Start time:07:50:02
            Start date:26/09/2024
            Path:C:\Users\user\AppData\Roaming\VajtonZVfAG.exe
            Wow64 process (32bit):true
            Commandline:"C:\Users\user\AppData\Roaming\VajtonZVfAG.exe"
            Imagebase:0xce0000
            File size:730'632 bytes
            MD5 hash:25E0C13B707F3EBCE3F35E806AC547D7
            Has elevated privileges:false
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Reputation:low
            Has exited:true

            General

            Target ID:24
            Start time:07:50:40
            Start date:26/09/2024
            Path:C:\Windows\System32\svchost.exe
            Wow64 process (32bit):false
            Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
            Imagebase:0x7ff7403e0000
            File size:55'320 bytes
            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
            Has elevated privileges:true
            Has administrator privileges:false
            Programmed in:C, C++ or other language
            Has exited:false

            Disassembly

            Reset < >

              Execution Graph

              Execution Coverage:12.3%
              Dynamic/Decrypted Code Coverage:100%
              Signature Coverage:0%
              Total number of Nodes:185
              Total number of Limit Nodes:9
              execution_graph 24940 75bb9da 24941 75bb96a 24940->24941 24943 75bb9e2 24940->24943 24944 75bb979 PostMessageW 24941->24944 24945 75bb9b4 24944->24945 24945->24940 25130 155d380 25131 155d3c6 GetCurrentProcess 25130->25131 25133 155d418 GetCurrentThread 25131->25133 25137 155d411 25131->25137 25134 155d455 GetCurrentProcess 25133->25134 25135 155d44e 25133->25135 25136 155d48b 25134->25136 25135->25134 25138 155d4b3 GetCurrentThreadId 25136->25138 25137->25133 25139 155d4e4 25138->25139 25142 155aff0 25146 155b0d8 25142->25146 25151 155b0e8 25142->25151 25143 155afff 25147 155b11c 25146->25147 25148 155b0f9 25146->25148 25147->25143 25148->25147 25149 155b320 GetModuleHandleW 25148->25149 25150 155b34d 25149->25150 25150->25143 25152 155b11c 25151->25152 25153 155b0f9 25151->25153 25152->25143 25153->25152 25154 155b320 GetModuleHandleW 25153->25154 25155 155b34d 25154->25155 25155->25143 25140 155d5c8 DuplicateHandle 25141 155d65e 25140->25141 25156 1554668 25157 155467a 25156->25157 25158 1554686 25157->25158 25160 1554778 25157->25160 25161 155479d 25160->25161 25165 1554878 25161->25165 25169 1554888 25161->25169 25166 15548af 25165->25166 25167 155498c 25166->25167 25173 1554514 25166->25173 25171 15548af 25169->25171 25170 155498c 25170->25170 25171->25170 25172 1554514 CreateActCtxA 25171->25172 25172->25170 25174 1555918 CreateActCtxA 25173->25174 25176 15559db 25174->25176 25176->25176 24946 75b7a95 24947 75b7a9f 24946->24947 24948 75b799c 24946->24948 24951 75b9fca 24947->24951 24966 75b9fd8 24947->24966 24952 75b9ff2 24951->24952 24953 75b9ffa 24952->24953 24981 75ba8af 24952->24981 24985 75ba7ea 24952->24985 24990 75ba6d0 24952->24990 24999 75ba512 24952->24999 25009 75ba63f 24952->25009 25013 75ba798 24952->25013 25023 75ba419 24952->25023 25028 75ba886 24952->25028 25038 75bade7 24952->25038 25042 75ba5a1 24952->25042 25051 75ba68c 24952->25051 25056 75ba48e 24952->25056 24953->24948 24967 75b9ff2 24966->24967 24968 75b9ffa 24967->24968 24969 75ba419 2 API calls 24967->24969 24970 75ba798 4 API calls 24967->24970 24971 75ba63f 2 API calls 24967->24971 24972 75ba512 6 API calls 24967->24972 24973 75ba6d0 4 API calls 24967->24973 24974 75ba7ea 2 API calls 24967->24974 24975 75ba8af 2 API calls 24967->24975 24976 75ba48e 2 API calls 24967->24976 24977 75ba68c 2 API calls 24967->24977 24978 75ba5a1 4 API calls 24967->24978 24979 75bade7 2 API calls 24967->24979 24980 75ba886 6 API calls 24967->24980 24968->24948 24969->24968 24970->24968 24971->24968 24972->24968 24973->24968 24974->24968 24975->24968 24976->24968 24977->24968 24978->24968 24979->24968 24980->24968 25061 75b73e8 24981->25061 25065 75b73e0 24981->25065 24982 75ba8d1 24982->24953 24986 75ba7f1 24985->24986 25069 75bb648 24986->25069 25074 75bb637 24986->25074 24987 75ba81b 24987->24953 25087 75b6d28 24990->25087 25091 75b6d21 24990->25091 24991 75ba5b8 24991->24990 24992 75ba9f3 24991->24992 24993 75ba809 24991->24993 24992->24953 24997 75bb648 2 API calls 24993->24997 24998 75bb637 2 API calls 24993->24998 24994 75ba81b 24994->24953 24997->24994 24998->24994 25000 75ba4ea 24999->25000 25001 75ba739 25000->25001 25002 75ba4fc 25000->25002 25095 75b72f8 25000->25095 25099 75b72f0 25000->25099 25103 75b7230 25000->25103 25107 75b7238 25000->25107 25001->25002 25111 75bafe8 25001->25111 25116 75bafd7 25001->25116 25002->24953 25011 75b72f8 WriteProcessMemory 25009->25011 25012 75b72f0 WriteProcessMemory 25009->25012 25010 75ba66d 25010->24953 25011->25010 25012->25010 25014 75ba5b8 25013->25014 25015 75ba7a5 25013->25015 25016 75ba9f3 25014->25016 25017 75ba809 25014->25017 25019 75b6d28 Wow64SetThreadContext 25014->25019 25020 75b6d21 Wow64SetThreadContext 25014->25020 25015->24953 25016->24953 25021 75bb648 2 API calls 25017->25021 25022 75bb637 2 API calls 25017->25022 25018 75ba81b 25018->24953 25019->25014 25020->25014 25021->25018 25022->25018 25024 75ba423 25023->25024 25121 75b7580 25024->25121 25125 75b7574 25024->25125 25029 75ba4ea 25028->25029 25030 75ba739 25029->25030 25031 75ba4fc 25029->25031 25032 75b7238 VirtualAllocEx 25029->25032 25033 75b7230 VirtualAllocEx 25029->25033 25034 75b72f8 WriteProcessMemory 25029->25034 25035 75b72f0 WriteProcessMemory 25029->25035 25030->25031 25036 75bafe8 2 API calls 25030->25036 25037 75bafd7 2 API calls 25030->25037 25031->24953 25032->25029 25033->25029 25034->25029 25035->25029 25036->25031 25037->25031 25040 75b72f8 WriteProcessMemory 25038->25040 25041 75b72f0 WriteProcessMemory 25038->25041 25039 75bae0b 25040->25039 25041->25039 25044 75ba5a7 25042->25044 25043 75ba809 25047 75bb648 2 API calls 25043->25047 25048 75bb637 2 API calls 25043->25048 25044->25043 25045 75ba9f3 25044->25045 25049 75b6d28 Wow64SetThreadContext 25044->25049 25050 75b6d21 Wow64SetThreadContext 25044->25050 25045->24953 25046 75ba81b 25046->24953 25047->25046 25048->25046 25049->25044 25050->25044 25052 75ba699 25051->25052 25054 75bb648 2 API calls 25052->25054 25055 75bb637 2 API calls 25052->25055 25053 75ba81b 25053->24953 25054->25053 25055->25053 25057 75ba494 25056->25057 25058 75ba4c5 25057->25058 25059 75b7580 CreateProcessA 25057->25059 25060 75b7574 CreateProcessA 25057->25060 25058->24953 25059->25058 25060->25058 25062 75b7433 ReadProcessMemory 25061->25062 25064 75b7477 25062->25064 25064->24982 25066 75b73e8 ReadProcessMemory 25065->25066 25068 75b7477 25066->25068 25068->24982 25070 75bb65d 25069->25070 25079 75b6c78 25070->25079 25083 75b6c70 25070->25083 25071 75bb670 25071->24987 25075 75bb65d 25074->25075 25077 75b6c78 ResumeThread 25075->25077 25078 75b6c70 ResumeThread 25075->25078 25076 75bb670 25076->24987 25077->25076 25078->25076 25080 75b6cb8 ResumeThread 25079->25080 25082 75b6ce9 25080->25082 25082->25071 25084 75b6cb8 ResumeThread 25083->25084 25086 75b6ce9 25084->25086 25086->25071 25088 75b6d6d Wow64SetThreadContext 25087->25088 25090 75b6db5 25088->25090 25090->24991 25092 75b6d6d Wow64SetThreadContext 25091->25092 25094 75b6db5 25092->25094 25094->24991 25096 75b7340 WriteProcessMemory 25095->25096 25098 75b7397 25096->25098 25098->25000 25100 75b72f8 WriteProcessMemory 25099->25100 25102 75b7397 25100->25102 25102->25000 25104 75b7278 VirtualAllocEx 25103->25104 25106 75b72b5 25104->25106 25106->25000 25108 75b7278 VirtualAllocEx 25107->25108 25110 75b72b5 25108->25110 25110->25000 25112 75baffd 25111->25112 25114 75b6d28 Wow64SetThreadContext 25112->25114 25115 75b6d21 Wow64SetThreadContext 25112->25115 25113 75bb013 25113->25002 25114->25113 25115->25113 25117 75baffd 25116->25117 25119 75b6d28 Wow64SetThreadContext 25117->25119 25120 75b6d21 Wow64SetThreadContext 25117->25120 25118 75bb013 25118->25002 25119->25118 25120->25118 25122 75b7609 25121->25122 25122->25122 25123 75b776e CreateProcessA 25122->25123 25124 75b77cb 25123->25124 25126 75b7504 25125->25126 25127 75b757e CreateProcessA 25125->25127 25126->24953 25129 75b77cb 25127->25129 25129->25129

              Executed Functions

              Function 075B1982 Relevance: .2, Instructions: 247COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a3c2f019806dbb377d6dac5f421305a43f1f3c176f5a161f87a73dc980b104fa
              • Instruction ID: e85dec7197246de8b0e4ce6f6d980fd47069b2c9905ba1f7218d7e21195e8a2d
              • Opcode Fuzzy Hash: a3c2f019806dbb377d6dac5f421305a43f1f3c176f5a161f87a73dc980b104fa
              • Instruction Fuzzy Hash: E4B1E3B4E14218CFCB64CF65C990AEDBBF6BB8E300F1494AAD909A7355D7319A81CF50
              Function 075B18EF Relevance: .1, Instructions: 63COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8cad5aff34290d0d6323a93f6a6887b7b701ca0fb7ad3a0d1216e703d7aa5ada
              • Instruction ID: b4f80b94fa370283f407f419b428d09f6d3838371fce1f5e44d9f152f32ec677
              • Opcode Fuzzy Hash: 8cad5aff34290d0d6323a93f6a6887b7b701ca0fb7ad3a0d1216e703d7aa5ada
              • Instruction Fuzzy Hash: 2E213EB1D046588BDB58CF67C9153EEFFF7AFCA300F14C46A9409A6255DB7009458F40
              Function 075B1900 Relevance: .1, Instructions: 58COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bfd00b2fec07a5a0dbee3686c4d83285779d0a53550acbce6dbe69d0096d7391
              • Instruction ID: 7f6e4c3f309053c0b437e14ce91060377b5ec58e53e8dcdcd4a9b3623c8f6885
              • Opcode Fuzzy Hash: bfd00b2fec07a5a0dbee3686c4d83285779d0a53550acbce6dbe69d0096d7391
              • Instruction Fuzzy Hash: 4211F9B0D14A588BEB68CF67C9553EEFAFBAFC9300F14D46A9409A6254DB7009458F80
              Function 0155D371 Relevance: 6.1, APIs: 4, Instructions: 149threadCOMMON
              Download Yara Rule

              Control-flow Graph

              APIs
              • GetCurrentProcess.KERNEL32 ref: 0155D3FE
              • GetCurrentThread.KERNEL32 ref: 0155D43B
              • GetCurrentProcess.KERNEL32 ref: 0155D478
              • GetCurrentThreadId.KERNEL32 ref: 0155D4D1
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: Current$ProcessThread
              • String ID:
              • API String ID: 2063062207-0
              • Opcode ID: 4b757e72f47368d1f1dbb9a800c8a5ce702b4f572729eed8ae456db4ebe025ca
              • Instruction ID: 655ba1f5f515f0ccbd51b7a00f6f08d826b07d6e606ce7ff8f777accda6a86b4
              • Opcode Fuzzy Hash: 4b757e72f47368d1f1dbb9a800c8a5ce702b4f572729eed8ae456db4ebe025ca
              • Instruction Fuzzy Hash: FD6147B190020ACFDB48DFA9D588BDEBFF1FF88314F20845AD509AB251DBB56944CB61
              Function 0155D380 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
              Download Yara Rule

              Control-flow Graph

              APIs
              • GetCurrentProcess.KERNEL32 ref: 0155D3FE
              • GetCurrentThread.KERNEL32 ref: 0155D43B
              • GetCurrentProcess.KERNEL32 ref: 0155D478
              • GetCurrentThreadId.KERNEL32 ref: 0155D4D1
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: Current$ProcessThread
              • String ID:
              • API String ID: 2063062207-0
              • Opcode ID: 11445c6cd67ca2ffdd2a3d2ec5dd79566c52a44b2f1de5b242f9127b8bb2c438
              • Instruction ID: 0e3ddaf40096957831035d7b0ee9bbf4b4d440d6b2f7a8970f82e7dbec70a7a3
              • Opcode Fuzzy Hash: 11445c6cd67ca2ffdd2a3d2ec5dd79566c52a44b2f1de5b242f9127b8bb2c438
              • Instruction Fuzzy Hash: 5F5135B190030ACFDB54CFA9D588BDEBFF1BF88314F20845AE509A7290DBB46944CB65
              Function 075B7574 Relevance: 1.8, APIs: 1, Instructions: 283processCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 51 75b7574-75b757c 52 75b757e-75b7615 51->52 53 75b7504-75b753a 51->53 57 75b764e-75b766e 52->57 58 75b7617-75b7621 52->58 67 75b753c-75b7542 53->67 68 75b7543-75b7568 53->68 69 75b7670-75b767a 57->69 70 75b76a7-75b76d6 57->70 58->57 60 75b7623-75b7625 58->60 61 75b7648-75b764b 60->61 62 75b7627-75b7631 60->62 61->57 65 75b7633 62->65 66 75b7635-75b7644 62->66 65->66 66->66 71 75b7646 66->71 67->68 69->70 72 75b767c-75b767e 69->72 80 75b76d8-75b76e2 70->80 81 75b770f-75b77c9 CreateProcessA 70->81 71->61 73 75b76a1-75b76a4 72->73 74 75b7680-75b768a 72->74 73->70 78 75b768e-75b769d 74->78 79 75b768c 74->79 78->78 82 75b769f 78->82 79->78 80->81 83 75b76e4-75b76e6 80->83 93 75b77cb-75b77d1 81->93 94 75b77d2-75b7858 81->94 82->73 86 75b7709-75b770c 83->86 87 75b76e8-75b76f2 83->87 86->81 88 75b76f6-75b7705 87->88 89 75b76f4 87->89 88->88 91 75b7707 88->91 89->88 91->86 93->94 104 75b785a-75b785e 94->104 105 75b7868-75b786c 94->105 104->105 106 75b7860 104->106 107 75b786e-75b7872 105->107 108 75b787c-75b7880 105->108 106->105 107->108 111 75b7874 107->111 109 75b7882-75b7886 108->109 110 75b7890-75b7894 108->110 109->110 112 75b7888 109->112 113 75b78a6-75b78ad 110->113 114 75b7896-75b789c 110->114 111->108 112->110 115 75b78af-75b78be 113->115 116 75b78c4 113->116 114->113 115->116 118 75b78c5 116->118 118->118
              APIs
              • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 075B77B6
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: CreateProcess
              • String ID:
              • API String ID: 963392458-0
              • Opcode ID: 2c3daf04dd90b372a6e5f8db1b7bc6df555806fdd64751f87675926acb4c835a
              • Instruction ID: fadb5b5a0dd5ccc064fbe9470b65fe5661e7c358df0ebf443f5ecb83b34f563d
              • Opcode Fuzzy Hash: 2c3daf04dd90b372a6e5f8db1b7bc6df555806fdd64751f87675926acb4c835a
              • Instruction Fuzzy Hash: 31B180B1D0065ACFEF20CF69C8417EDBBB2BF88310F14856AD819A7280DB749985CF91
              Function 075B7580 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 119 75b7580-75b7615 121 75b764e-75b766e 119->121 122 75b7617-75b7621 119->122 129 75b7670-75b767a 121->129 130 75b76a7-75b76d6 121->130 122->121 123 75b7623-75b7625 122->123 124 75b7648-75b764b 123->124 125 75b7627-75b7631 123->125 124->121 127 75b7633 125->127 128 75b7635-75b7644 125->128 127->128 128->128 131 75b7646 128->131 129->130 132 75b767c-75b767e 129->132 138 75b76d8-75b76e2 130->138 139 75b770f-75b77c9 CreateProcessA 130->139 131->124 133 75b76a1-75b76a4 132->133 134 75b7680-75b768a 132->134 133->130 136 75b768e-75b769d 134->136 137 75b768c 134->137 136->136 140 75b769f 136->140 137->136 138->139 141 75b76e4-75b76e6 138->141 150 75b77cb-75b77d1 139->150 151 75b77d2-75b7858 139->151 140->133 143 75b7709-75b770c 141->143 144 75b76e8-75b76f2 141->144 143->139 145 75b76f6-75b7705 144->145 146 75b76f4 144->146 145->145 148 75b7707 145->148 146->145 148->143 150->151 161 75b785a-75b785e 151->161 162 75b7868-75b786c 151->162 161->162 163 75b7860 161->163 164 75b786e-75b7872 162->164 165 75b787c-75b7880 162->165 163->162 164->165 168 75b7874 164->168 166 75b7882-75b7886 165->166 167 75b7890-75b7894 165->167 166->167 169 75b7888 166->169 170 75b78a6-75b78ad 167->170 171 75b7896-75b789c 167->171 168->165 169->167 172 75b78af-75b78be 170->172 173 75b78c4 170->173 171->170 172->173 175 75b78c5 173->175 175->175
              APIs
              • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 075B77B6
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: CreateProcess
              • String ID:
              • API String ID: 963392458-0
              • Opcode ID: 9abbcf63f6cd7935e7e8edb3df2d11e3c1b69f08eeaf470d86243155f6f1f4a5
              • Instruction ID: 647af0cb940abc20aff350f0d1bafc2f229a6a70df57b98e89f074bf17b9577f
              • Opcode Fuzzy Hash: 9abbcf63f6cd7935e7e8edb3df2d11e3c1b69f08eeaf470d86243155f6f1f4a5
              • Instruction Fuzzy Hash: 849152B1D0065ADFEF24CF69C8417EDBBB2BF88310F1485AAD819A7240DB749985CF91
              Function 0155B0E8 Relevance: 1.7, APIs: 1, Instructions: 195COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 176 155b0e8-155b0f7 177 155b123-155b127 176->177 178 155b0f9-155b106 call 155ada0 176->178 180 155b129-155b133 177->180 181 155b13b-155b17c 177->181 185 155b11c 178->185 186 155b108 178->186 180->181 187 155b17e-155b186 181->187 188 155b189-155b197 181->188 185->177 233 155b10e call 155b370 186->233 234 155b10e call 155b380 186->234 187->188 189 155b199-155b19e 188->189 190 155b1bb-155b1bd 188->190 193 155b1a0-155b1a7 call 155adac 189->193 194 155b1a9 189->194 192 155b1c0-155b1c7 190->192 191 155b114-155b116 191->185 195 155b258-155b318 191->195 197 155b1d4-155b1db 192->197 198 155b1c9-155b1d1 192->198 199 155b1ab-155b1b9 193->199 194->199 226 155b320-155b34b GetModuleHandleW 195->226 227 155b31a-155b31d 195->227 200 155b1dd-155b1e5 197->200 201 155b1e8-155b1f1 call 155adbc 197->201 198->197 199->192 200->201 207 155b1f3-155b1fb 201->207 208 155b1fe-155b203 201->208 207->208 209 155b205-155b20c 208->209 210 155b221-155b225 208->210 209->210 212 155b20e-155b21e call 155adcc call 155addc 209->212 231 155b228 call 155b651 210->231 232 155b228 call 155b680 210->232 212->210 215 155b22b-155b22e 217 155b251-155b257 215->217 218 155b230-155b24e 215->218 218->217 228 155b354-155b368 226->228 229 155b34d-155b353 226->229 227->226 229->228 231->215 232->215 233->191 234->191
              APIs
              • GetModuleHandleW.KERNEL32(00000000), ref: 0155B33E
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: HandleModule
              • String ID:
              • API String ID: 4139908857-0
              • Opcode ID: fdfc303248af8904afabf83e394ddea3ef8559a79d452426ecb65b560d6a8872
              • Instruction ID: 42fe0b1e0d925ea276f4a7fff12a91e0b2d0df9b57cb002de6e9cc5762f9aba5
              • Opcode Fuzzy Hash: fdfc303248af8904afabf83e394ddea3ef8559a79d452426ecb65b560d6a8872
              • Instruction Fuzzy Hash: 6B714970A00B058FD7A4DF69D46475ABBF2FF88204F108A2ED94ADBB40DB75E845CB91
              Function 0155590C Relevance: 1.6, APIs: 1, Instructions: 100COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 235 155590c-15559d9 CreateActCtxA 237 15559e2-1555a3c 235->237 238 15559db-15559e1 235->238 245 1555a3e-1555a41 237->245 246 1555a4b-1555a4f 237->246 238->237 245->246 247 1555a51-1555a5d 246->247 248 1555a60 246->248 247->248 250 1555a61 248->250 250->250
              APIs
              • CreateActCtxA.KERNEL32(?), ref: 015559C9
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: Create
              • String ID:
              • API String ID: 2289755597-0
              • Opcode ID: 55097b6b615f83b5c260c8b3b759017a2c0e7e0f5e3cb124cad6cead8f408f6a
              • Instruction ID: ca8007d4a2d4abb4098864724d8038865851d1a2da40be5665b8ea09640a4c46
              • Opcode Fuzzy Hash: 55097b6b615f83b5c260c8b3b759017a2c0e7e0f5e3cb124cad6cead8f408f6a
              • Instruction Fuzzy Hash: 6F41F2B0C00719CFEB24CFA9C894BDDBBB1BF48714F20816AD508AB251DBB5694ACF50
              Function 01554514 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 251 1554514-15559d9 CreateActCtxA 254 15559e2-1555a3c 251->254 255 15559db-15559e1 251->255 262 1555a3e-1555a41 254->262 263 1555a4b-1555a4f 254->263 255->254 262->263 264 1555a51-1555a5d 263->264 265 1555a60 263->265 264->265 267 1555a61 265->267 267->267
              APIs
              • CreateActCtxA.KERNEL32(?), ref: 015559C9
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: Create
              • String ID:
              • API String ID: 2289755597-0
              • Opcode ID: 4416dd1659fc60e7719886264290751ea2b5e1b44f9e80fedeb8e7e979c63574
              • Instruction ID: 4a8366a4721139f88687b164fdf17f103cec106e5cc4bf208f3b5c1e098dfadd
              • Opcode Fuzzy Hash: 4416dd1659fc60e7719886264290751ea2b5e1b44f9e80fedeb8e7e979c63574
              • Instruction Fuzzy Hash: 7D41F5B0C0071DCBDB24DFA9C994B8EBBF5BF44704F60815AD508AB251DBB56949CF90
              Function 075B72F0 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 268 75b72f0-75b7346 271 75b7348-75b7354 268->271 272 75b7356-75b7395 WriteProcessMemory 268->272 271->272 274 75b739e-75b73ce 272->274 275 75b7397-75b739d 272->275 275->274
              APIs
              • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 075B7388
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: MemoryProcessWrite
              • String ID:
              • API String ID: 3559483778-0
              • Opcode ID: 127ae81e6181d7d8930a4894bd77c0ab604b1d331e1bfe24c66e60a7af2bacfc
              • Instruction ID: 12c16b5201ecdab72a7bc42f558905d58445a86afc5181c9e8fbff3747ab31e1
              • Opcode Fuzzy Hash: 127ae81e6181d7d8930a4894bd77c0ab604b1d331e1bfe24c66e60a7af2bacfc
              • Instruction Fuzzy Hash: D6214BB2900349DFDB10CFA9C985BEEBBF5FF88310F14842AE919A7240D7759554CBA4
              Function 075B72F8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 279 75b72f8-75b7346 281 75b7348-75b7354 279->281 282 75b7356-75b7395 WriteProcessMemory 279->282 281->282 284 75b739e-75b73ce 282->284 285 75b7397-75b739d 282->285 285->284
              APIs
              • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 075B7388
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: MemoryProcessWrite
              • String ID:
              • API String ID: 3559483778-0
              • Opcode ID: a5604f2e2989f76f02787302f31d3dd9a3de7bb86861192eef2644caac12ca39
              • Instruction ID: 4c8145afed50c24c2aacaa08018b7c2c59bc80cbc469d565459f5fdf035652cf
              • Opcode Fuzzy Hash: a5604f2e2989f76f02787302f31d3dd9a3de7bb86861192eef2644caac12ca39
              • Instruction Fuzzy Hash: 1521F8B19003599FDB10CFA9C985BEEBBF5FF88310F14842AE919A7240D7789554CBA4
              Function 075B6D21 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 289 75b6d21-75b6d73 291 75b6d83-75b6db3 Wow64SetThreadContext 289->291 292 75b6d75-75b6d81 289->292 294 75b6dbc-75b6dec 291->294 295 75b6db5-75b6dbb 291->295 292->291 295->294
              APIs
              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 075B6DA6
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ContextThreadWow64
              • String ID:
              • API String ID: 983334009-0
              • Opcode ID: 6bc333a628fedd1accdc9970b7e06dd06f2053eaff425e5ad9da501c6c38ca4b
              • Instruction ID: c9ac3c7de68011d78b8865bf65bb8efe3f953589a8fec7b32a36a8a7e6c0f62d
              • Opcode Fuzzy Hash: 6bc333a628fedd1accdc9970b7e06dd06f2053eaff425e5ad9da501c6c38ca4b
              • Instruction Fuzzy Hash: 852148B19003098FDB10DFAAC8857EEBBF4FF88324F54842AD518A7240DB789944CBA0
              Function 075B73E0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 299 75b73e0-75b7475 ReadProcessMemory 303 75b747e-75b74ae 299->303 304 75b7477-75b747d 299->304 304->303
              APIs
              • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 075B7468
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: MemoryProcessRead
              • String ID:
              • API String ID: 1726664587-0
              • Opcode ID: feb0cef01fe60db50eeeaa408a5d5bf8829f8b62a5cae1a6154178f559daee1e
              • Instruction ID: 2cd5e4e912d12842d6298b3b403d3a4c4f921044135821fcc8c71914a8984dc8
              • Opcode Fuzzy Hash: feb0cef01fe60db50eeeaa408a5d5bf8829f8b62a5cae1a6154178f559daee1e
              • Instruction Fuzzy Hash: 3A2107B1D003599FDB10CFAAC985BEEBBF5FF48310F14842AE518A7250D7789914CBA5
              Function 075B6D28 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 308 75b6d28-75b6d73 310 75b6d83-75b6db3 Wow64SetThreadContext 308->310 311 75b6d75-75b6d81 308->311 313 75b6dbc-75b6dec 310->313 314 75b6db5-75b6dbb 310->314 311->310 314->313
              APIs
              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 075B6DA6
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ContextThreadWow64
              • String ID:
              • API String ID: 983334009-0
              • Opcode ID: 38ea6cdf971b6ca96f4d4dd18aeb7006784983c4eb66aec8ab9281086ffb0fcb
              • Instruction ID: 91e235036660d669fc7fa69699cc053ec89982c538332b0fb48a16e24c2a3c4a
              • Opcode Fuzzy Hash: 38ea6cdf971b6ca96f4d4dd18aeb7006784983c4eb66aec8ab9281086ffb0fcb
              • Instruction Fuzzy Hash: B92138B19003098FDB50DFAAC4857EEBBF4FF88320F54842AD519A7240DB789944CFA4
              Function 075B73E8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 318 75b73e8-75b7475 ReadProcessMemory 321 75b747e-75b74ae 318->321 322 75b7477-75b747d 318->322 322->321
              APIs
              • ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 075B7468
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: MemoryProcessRead
              • String ID:
              • API String ID: 1726664587-0
              • Opcode ID: 238564b776c84e015bd98f5b3d91886bda2f744cce023a85673b8857834867a0
              • Instruction ID: a1d54c0da202e8bb5706d477b217b1ebaafcaad035ce08e686f5875af96b4d4b
              • Opcode Fuzzy Hash: 238564b776c84e015bd98f5b3d91886bda2f744cce023a85673b8857834867a0
              • Instruction Fuzzy Hash: 432128B1D003599FDB10CFAAC981BEEBBF5FF88310F10842AE518A7240D7789514CBA5
              Function 0155D5C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 326 155d5c8-155d65c DuplicateHandle 327 155d665-155d682 326->327 328 155d65e-155d664 326->328 328->327
              APIs
              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0155D64F
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: DuplicateHandle
              • String ID:
              • API String ID: 3793708945-0
              • Opcode ID: 5f49aef6e752ce1724a090a031fabd4aaaf30b7353ca62cb36c5efcb1f92c3fb
              • Instruction ID: b7047e49f71d664bb2d56d2af853557b0885667cbe495514d67de541747dd486
              • Opcode Fuzzy Hash: 5f49aef6e752ce1724a090a031fabd4aaaf30b7353ca62cb36c5efcb1f92c3fb
              • Instruction Fuzzy Hash: 9921C4B59002499FDB10CF9AD984ADEBFF4FB48320F14841AE918A7350D379A954CF65
              Function 0155D5C1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 331 155d5c1-155d65c DuplicateHandle 332 155d665-155d682 331->332 333 155d65e-155d664 331->333 333->332
              APIs
              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0155D64F
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: DuplicateHandle
              • String ID:
              • API String ID: 3793708945-0
              • Opcode ID: 0c09f5b5091c5b937cfb81b2c074023d42bf92763eff028abb018e285c694467
              • Instruction ID: e7d17a1888f3fd35171bae010d76d5a822d448107206a3e1958cdc39ee3c5d99
              • Opcode Fuzzy Hash: 0c09f5b5091c5b937cfb81b2c074023d42bf92763eff028abb018e285c694467
              • Instruction Fuzzy Hash: BD21E2B6900209DFDB10CFA9D584ADEBBF4FB48320F14841AE918A7350D378A954CF65
              Function 075B7230 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON
              Download Yara Rule
              APIs
              • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 075B72A6
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: AllocVirtual
              • String ID:
              • API String ID: 4275171209-0
              • Opcode ID: 55212078e42bd27bec0562b599ae666e6fbae1bd60306808fa7971d5967d4fcb
              • Instruction ID: 9a28b100121708cc68f732469709eb5a425000d1ff91056ae373b058fcce83a2
              • Opcode Fuzzy Hash: 55212078e42bd27bec0562b599ae666e6fbae1bd60306808fa7971d5967d4fcb
              • Instruction Fuzzy Hash: 31116A728002499FDB20CFA9C8457EEFFF1FF88320F14881AE519A7250CB759550CBA1
              Function 075B6C70 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON
              Download Yara Rule
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ResumeThread
              • String ID:
              • API String ID: 947044025-0
              • Opcode ID: 70f2dd19533a8f01d0f8bd0b2c3eee14bedb8c8a755a3f345114cc9de8ab00dc
              • Instruction ID: 12ab1690b87000601130b5bed14afe3986b893e04c6605dce04a8325c50a9dc6
              • Opcode Fuzzy Hash: 70f2dd19533a8f01d0f8bd0b2c3eee14bedb8c8a755a3f345114cc9de8ab00dc
              • Instruction Fuzzy Hash: DE118BB19003498FDB20CFAAC4457EFFBF4EF88320F24841AD519A7640DB756504CB94
              Function 075B7238 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
              Download Yara Rule
              APIs
              • VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 075B72A6
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: AllocVirtual
              • String ID:
              • API String ID: 4275171209-0
              • Opcode ID: 2177661bc0c71ffc90df471e31fc21014fec511754bc5cfd8c54c46cd87ede0d
              • Instruction ID: 333f47ed306b8bb8f9d4a05264409c060c2008a8368ce0c1d42f29abed3ec42d
              • Opcode Fuzzy Hash: 2177661bc0c71ffc90df471e31fc21014fec511754bc5cfd8c54c46cd87ede0d
              • Instruction Fuzzy Hash: D31129719002499FDB20DFAAC845BDEBBF5EF88320F14881AE515A7250C7759554CBA0
              Function 075B6C78 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
              Download Yara Rule
              APIs
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ResumeThread
              • String ID:
              • API String ID: 947044025-0
              • Opcode ID: 57c32e6a42b45d8f16a5d75dcf1e0c781c99348267bf7dc8882964d9c2b6d0a8
              • Instruction ID: 90f4491214f3764a796c4e3687b8f60c0249b26b445488cd0e0e8c96d58432d1
              • Opcode Fuzzy Hash: 57c32e6a42b45d8f16a5d75dcf1e0c781c99348267bf7dc8882964d9c2b6d0a8
              • Instruction Fuzzy Hash: 4E113AB19003498FDB20DFAAC4457EEFBF4EF88724F248419D519A7240CB756544CB94
              Function 075BB940 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON
              Download Yara Rule
              APIs
              • PostMessageW.USER32(?,00000010,00000000,?), ref: 075BB9A5
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: MessagePost
              • String ID:
              • API String ID: 410705778-0
              • Opcode ID: 0417270b99c87e148bf36a11fe5dff9ad2bf38e1193bc9dc52e9eb6bc5ec9525
              • Instruction ID: 81d6bc3c3d995ac138b51ea3a77a1b75ee8c7b850fe9e84809253c122da510d0
              • Opcode Fuzzy Hash: 0417270b99c87e148bf36a11fe5dff9ad2bf38e1193bc9dc52e9eb6bc5ec9525
              • Instruction Fuzzy Hash: 4F1102B5800349DFDB20CF9AC985BDEBBF8FB48324F14845AD558A7210D3B5A944CFA1
              Function 0155B2D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
              Download Yara Rule
              APIs
              • GetModuleHandleW.KERNEL32(00000000), ref: 0155B33E
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID: HandleModule
              • String ID:
              • API String ID: 4139908857-0
              • Opcode ID: e40f4b0578866a7ebac8a94a8ee1b386cdb2fb12573fe1f8dbe3354df6ebe57e
              • Instruction ID: dbfe0c3cad8a5585202e1c2488c17c01f446a80db6ecc4faa17bbd8a3ad3c97d
              • Opcode Fuzzy Hash: e40f4b0578866a7ebac8a94a8ee1b386cdb2fb12573fe1f8dbe3354df6ebe57e
              • Instruction Fuzzy Hash: BC110FB6C002498FDB10CF9AC448B9EFBF5AF88224F14845AD919B7210D3B9A545CFA1
              Function 075BB979 Relevance: 1.5, APIs: 1, Instructions: 30windowCOMMON
              Download Yara Rule
              APIs
              • PostMessageW.USER32(?,00000010,00000000,?), ref: 075BB9A5
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID: MessagePost
              • String ID:
              • API String ID: 410705778-0
              • Opcode ID: a66e827d0d27d6b37651618609d2896f3f764f97aad594920b7f6591d3c35fde
              • Instruction ID: 8c56ca54331cd027fa9d7b0302464eeebe33d8535a48ed95bc9331f9fcf9c865
              • Opcode Fuzzy Hash: a66e827d0d27d6b37651618609d2896f3f764f97aad594920b7f6591d3c35fde
              • Instruction Fuzzy Hash: 95F0C4B68003099FDB20CF99D444BDEBBF4FB88324F10841AE558A7250C3B9A554CFA1
              Function 0116D4C4 Relevance: .1, Instructions: 75COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115881944.000000000116D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0116D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_116d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a528a5575b60bac65584810975a2fec3c061963021ad2341b167f0de0acef44c
              • Instruction ID: f79eec9d593220bbc99cc9073f9f6cd91661a48faf0cbb09c9ad79fbf9094336
              • Opcode Fuzzy Hash: a528a5575b60bac65584810975a2fec3c061963021ad2341b167f0de0acef44c
              • Instruction Fuzzy Hash: 23213672600240DFDF09DF54E9C0B26BF79FB88318F20C169D9490B656C337D426CAA2
              Function 0117D1D4 Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115930180.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_117d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5a99d4ae08d3af2e8bda6ea352d6da061e1bd450349512e85bcb6d9a7ed707a4
              • Instruction ID: 94a98b58e2e21054a09aac2260ac154e0a9fad461816bc8337c173a9044ad4c9
              • Opcode Fuzzy Hash: 5a99d4ae08d3af2e8bda6ea352d6da061e1bd450349512e85bcb6d9a7ed707a4
              • Instruction Fuzzy Hash: 4821C175604208EFDF09DF94E580B25BB75FF84324F24C56DE90A4B352C776D446CA62
              Function 0117D01C Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115930180.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_117d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 48e584320728b7898d86487b349c6df9bfc7a21f82e977bd387fe2ad17abb272
              • Instruction ID: b4f54fef5a80eb835757544f0ebbf72e4038750570b7d076f4a801d2e6469494
              • Opcode Fuzzy Hash: 48e584320728b7898d86487b349c6df9bfc7a21f82e977bd387fe2ad17abb272
              • Instruction Fuzzy Hash: 51210075604208EFDF1ADF54E980B26BB71EF88314F20C56DD90A0B352C77AD446CA62
              Function 0117D006 Relevance: .1, Instructions: 62COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115930180.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_117d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 998f14b7cbb9815d0011242c14010703e6bbdf5468af3ffc10236b0f560f13ae
              • Instruction ID: 87a8bdf52f074629e6752899003903aa4a8b01d28dc6bcfe32075cfc5a631a02
              • Opcode Fuzzy Hash: 998f14b7cbb9815d0011242c14010703e6bbdf5468af3ffc10236b0f560f13ae
              • Instruction Fuzzy Hash: 89218B755093848FCB17CF64D990B15BF71EF46214F28C5EAD8498B2A7C33A980ACB62
              Function 0116D4BF Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115881944.000000000116D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0116D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_116d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
              • Instruction ID: 549eaede7f20961b7f5bbe418b1ae8eb357d4f95cce8d48d4298b3c522aa6b86
              • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
              • Instruction Fuzzy Hash: 4E11AF76504280CFCF16CF54E5C4B16BF71FB84318F24C6A9D8490B656C33AD466CBA2
              Function 0117D1CF Relevance: .1, Instructions: 53COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115930180.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_117d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
              • Instruction ID: df59b2e63e526bf27c75ac653c2c7c1a8bed1e6c31b60408509875c3ae9ebc04
              • Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
              • Instruction Fuzzy Hash: D211BB75504284DFCB06CF54D5C0B15BFB1FF84224F28C6A9D8494B3A6C33AD40ACB62
              Function 0116D745 Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115881944.000000000116D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0116D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_116d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2213bffaa6d57d783ca9ecefe94cce8202e3d260c27158e8fb29da1be865158a
              • Instruction ID: 42f95c854b036a606a3d6efcb752bd81d5e6ad6ec3152e4d9fe4b2839ee4d4e8
              • Opcode Fuzzy Hash: 2213bffaa6d57d783ca9ecefe94cce8202e3d260c27158e8fb29da1be865158a
              • Instruction Fuzzy Hash: DC0120716047809AFB184E99ED84B26BF9CDF41328F08C51ADE444E142D77E9440C773
              Function 0116D744 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2115881944.000000000116D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0116D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_116d000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: da579c22d5cd0a11c5a8d1ab9c7522257df14e77875b9bb4ab6e900d00914668
              • Instruction ID: 7a7463c67b9cddc115c9fcca541ecb6b106aaefbf9bf6aad9a40ba116c32079c
              • Opcode Fuzzy Hash: da579c22d5cd0a11c5a8d1ab9c7522257df14e77875b9bb4ab6e900d00914668
              • Instruction Fuzzy Hash: B2F0C2715043849AFB148E59D884B62FF9CEB81638F18C05AEE484A287C7799844CBB2

              Non-executed Functions

              Function 075BD0E8 Relevance: .4, Instructions: 382COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3dc836e64d3f831579cb697c0d66d0e7f078f3dc06d5477063f84612e7cff37e
              • Instruction ID: 659a6f2df8b62c406535b7debc2eec41e14efb465675e9e2b02416b4b1477508
              • Opcode Fuzzy Hash: 3dc836e64d3f831579cb697c0d66d0e7f078f3dc06d5477063f84612e7cff37e
              • Instruction Fuzzy Hash: 77D168B1B017068BDB69DB75C460BEEB7F6BFC9700F14846AD14A8B691CB35E801CB61
              Function 075B47B8 Relevance: .3, Instructions: 312COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 62fa92d8bb404309404b4331b057e0c6976c2193edb122ab7403678e56a00b57
              • Instruction ID: 9b9e54372b515d10bf7a9c9b6aa82b0eefd0904aeaa869d54e2cfe1624429274
              • Opcode Fuzzy Hash: 62fa92d8bb404309404b4331b057e0c6976c2193edb122ab7403678e56a00b57
              • Instruction Fuzzy Hash: 69E1EAB4E001598FDB24DFA9C590AAEFBF2BF89304F24825AD514A7356D7319942CF60
              Function 075B6E00 Relevance: .3, Instructions: 312COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 56ca5d20637437d57fddd86ce4997d2df6579e0040dcb7f7299e0e8154330cfb
              • Instruction ID: e0cc3663b99c5fc175ef92ac33c92a50eb59d5743ddc87d17e863af1f33b548c
              • Opcode Fuzzy Hash: 56ca5d20637437d57fddd86ce4997d2df6579e0040dcb7f7299e0e8154330cfb
              • Instruction Fuzzy Hash: 76E1EAB4E001598FDB14DFA9C590AAEFBF2FF89304F24866AD414A7355D731A942CF60
              Function 075B6450 Relevance: .3, Instructions: 312COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c53895e23adff2c45b6d768b92c1c4f0246a836d8b7c8627dfa48082ad093529
              • Instruction ID: 5488f3843c0485cd8c999a898867ad2aad55dbf3dc23dc359675b2843a4e16dc
              • Opcode Fuzzy Hash: c53895e23adff2c45b6d768b92c1c4f0246a836d8b7c8627dfa48082ad093529
              • Instruction Fuzzy Hash: B4E1E9B4E002598FDB14DFA9C590AEEBBF2FF89304F24826AD414A7355D730A942CF61
              Function 075B4BF0 Relevance: .3, Instructions: 312COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ed3330b39095a7a1c6c99adf50a47f157c6812ca88a66a24809f84db19efbd9e
              • Instruction ID: 33fd61aee71274da51222222ef9b786e2da4882ce5033b6cc5ae4309503c4647
              • Opcode Fuzzy Hash: ed3330b39095a7a1c6c99adf50a47f157c6812ca88a66a24809f84db19efbd9e
              • Instruction Fuzzy Hash: 6CE1EBB4E001598FDB24DFA9C590AEEFBF2BF89304F24825AD414A7356D731A942CF61
              Function 075B4380 Relevance: .3, Instructions: 312COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: efc7f00badeef9c2a4e8422fcfd04e45af9ec8bb8e20e634c1496a034b039c41
              • Instruction ID: 6cfeeab08ef860e612fc463067000baef67b6b45a5f9e8faf6f346e5571ac5be
              • Opcode Fuzzy Hash: efc7f00badeef9c2a4e8422fcfd04e45af9ec8bb8e20e634c1496a034b039c41
              • Instruction Fuzzy Hash: BAE1FCB4E001598FDB24DFA9C590AEEFBF2BF89304F24825AD415A7356D730A942CF61
              Function 0155DEEC Relevance: .3, Instructions: 264COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2124457673.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_1550000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 92a2cfb839ce6d1553e4811b3cdcbcdcd6c4e0f44b86011f9f9cf5c290a9eef1
              • Instruction ID: d58ce70ec94a02ce7ffaef5add06426487c44eee265452eee1790ced4607494f
              • Opcode Fuzzy Hash: 92a2cfb839ce6d1553e4811b3cdcbcdcd6c4e0f44b86011f9f9cf5c290a9eef1
              • Instruction Fuzzy Hash: 37A16B32E1021A8FCF15DFB4D8944AEBBB2FF85300B15856BE916AF265DB31E945CB40
              Function 075B6441 Relevance: .1, Instructions: 139COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b773ca00ffe0168542f911599f692ce5531ed1c294fff0638d71170b32cd3a1b
              • Instruction ID: d6f0bdd63c1c9248eaacf826425d0f3779a103a441fc97abec37bd335e286edf
              • Opcode Fuzzy Hash: b773ca00ffe0168542f911599f692ce5531ed1c294fff0638d71170b32cd3a1b
              • Instruction Fuzzy Hash: 28514AB0E002598FDB14DFA9D9905EEFBF2FF89300F24826AD418A7255D7309942CF60
              Function 075B4BE0 Relevance: .1, Instructions: 134COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000000.00000002.2146565718.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_0_2_75b0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4be5a41cdc743190db921b1a75bb3d7d9c15c4397dfd2847465e5d20ba0d90e5
              • Instruction ID: 874cdf448bc3121e89a4ad7f150c672e6b48f04ee3ea09597c2ea3205e3c83e2
              • Opcode Fuzzy Hash: 4be5a41cdc743190db921b1a75bb3d7d9c15c4397dfd2847465e5d20ba0d90e5
              • Instruction Fuzzy Hash: 4A512DB4E042598FDB14DFA9C5905EEFBF2BF89300F24C26AD418A7256D7319942CF60

              Execution Graph

              Execution Coverage:0.8%
              Dynamic/Decrypted Code Coverage:6.7%
              Signature Coverage:10.6%
              Total number of Nodes:104
              Total number of Limit Nodes:9
              execution_graph 95153 401920 95154 401932 95153->95154 95155 40197c 95153->95155 95155->95155 95158 42f6e3 95155->95158 95161 42dc13 95158->95161 95162 42dc39 95161->95162 95171 407063 95162->95171 95164 42dc4f 95170 401a25 95164->95170 95174 41aab3 95164->95174 95166 42dc6e 95167 42dc83 95166->95167 95168 42c383 ExitProcess 95166->95168 95185 42c383 95167->95185 95168->95167 95188 415e13 95171->95188 95173 407070 95173->95164 95175 41aadf 95174->95175 95212 41a9a3 95175->95212 95178 41ab24 95180 41ab40 95178->95180 95183 42bfe3 NtClose 95178->95183 95179 41ab0c 95181 41ab17 95179->95181 95218 42bfe3 95179->95218 95180->95166 95181->95166 95184 41ab36 95183->95184 95184->95166 95186 42c39d 95185->95186 95187 42c3ae ExitProcess 95186->95187 95187->95170 95189 415e30 95188->95189 95191 415e46 95189->95191 95192 42ca13 95189->95192 95191->95173 95194 42ca2d 95192->95194 95193 42ca5c 95193->95191 95194->95193 95199 42b663 95194->95199 95200 42b680 95199->95200 95206 f62c0a 95200->95206 95201 42b6a9 95203 42e053 95201->95203 95209 42c333 95203->95209 95205 42cacf 95205->95191 95207 f62c11 95206->95207 95208 f62c1f LdrInitializeThunk 95206->95208 95207->95201 95208->95201 95210 42c350 95209->95210 95211 42c35e RtlFreeHeap 95210->95211 95211->95205 95213 41aa99 95212->95213 95214 41a9bd 95212->95214 95213->95178 95213->95179 95221 42b703 95214->95221 95217 42bfe3 NtClose 95217->95213 95219 42bffd 95218->95219 95220 42c00b NtClose 95219->95220 95220->95181 95222 42b71d 95221->95222 95225 f635c0 LdrInitializeThunk 95222->95225 95223 41aa8d 95223->95217 95225->95223 95226 42f343 95227 42f2b3 95226->95227 95228 42f310 95227->95228 95232 42e133 95227->95232 95230 42f2ed 95231 42e053 RtlFreeHeap 95230->95231 95231->95228 95235 42c2f3 95232->95235 95234 42e14e 95234->95230 95236 42c30d 95235->95236 95237 42c31b RtlAllocateHeap 95236->95237 95237->95234 95238 4243c3 95239 4243df 95238->95239 95240 424407 95239->95240 95241 42441b 95239->95241 95242 42bfe3 NtClose 95240->95242 95243 42bfe3 NtClose 95241->95243 95245 424410 95242->95245 95244 424424 95243->95244 95248 42e173 RtlAllocateHeap 95244->95248 95247 42442f 95248->95247 95263 424753 95267 42476c 95263->95267 95264 4247b4 95265 42e053 RtlFreeHeap 95264->95265 95266 4247c1 95265->95266 95267->95264 95268 4247f1 95267->95268 95270 4247f6 95267->95270 95269 42e053 RtlFreeHeap 95268->95269 95269->95270 95271 42f213 95272 42f223 95271->95272 95273 42f229 95271->95273 95274 42e133 RtlAllocateHeap 95273->95274 95275 42f24f 95274->95275 95276 42b613 95277 42b62d 95276->95277 95280 f62df0 LdrInitializeThunk 95277->95280 95278 42b652 95280->95278 95249 413643 95253 413663 95249->95253 95251 4136cc 95252 4136c2 95253->95251 95254 41adc3 RtlFreeHeap LdrInitializeThunk 95253->95254 95254->95252 95255 413463 95258 42c263 95255->95258 95259 42c280 95258->95259 95262 f62c70 LdrInitializeThunk 95259->95262 95260 413485 95262->95260 95281 417153 95282 417177 95281->95282 95283 4171b3 LdrLoadDll 95282->95283 95284 41717e 95282->95284 95283->95284 95285 f62b60 LdrInitializeThunk

              Executed Functions

              Function 00417153 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 14 417153-41717c call 42ed53 17 417182-417190 call 42f353 14->17 18 41717e-417181 14->18 21 4171a0-4171b1 call 42d6e3 17->21 22 417192-41719d call 42f5f3 17->22 27 4171b3-4171c7 LdrLoadDll 21->27 28 4171ca-4171cd 21->28 22->21 27->28
              APIs
              • LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 004171C5
              Memory Dump Source
              • Source File: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_400000_Payment TT Copy.jbxd
              Yara matches
              Similarity
              • API ID: Load
              • String ID:
              • API String ID: 2234796835-0
              • Opcode ID: ba07f67e53e0cf5e44d38538f00e0368fd2be6024c43770566bd29dc4f468198
              • Instruction ID: b218bee332ae207791c3201e557852eed1578fae4a3e4e04b1486e33c52e6a4b
              • Opcode Fuzzy Hash: ba07f67e53e0cf5e44d38538f00e0368fd2be6024c43770566bd29dc4f468198
              • Instruction Fuzzy Hash: 770171B1E0020DBBDF10DBE1DC42FDEB378AB54308F4081AAE90897240F674EB488B95
              Function 0042BFE3 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 34 42bfe3-42c019 call 4044e3 call 42d1f3 NtClose
              APIs
              • NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042C014
              Memory Dump Source
              • Source File: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_400000_Payment TT Copy.jbxd
              Yara matches
              Similarity
              • API ID: Close
              • String ID:
              • API String ID: 3535843008-0
              • Opcode ID: 8ebffa444dc58d3b3492b878dad6112ed5d675857ba907a3f1e3c77e187f82a0
              • Instruction ID: 58908c1a41945f708c3c691cb6b1066a42e331216972b9dcc79f932992deb58b
              • Opcode Fuzzy Hash: 8ebffa444dc58d3b3492b878dad6112ed5d675857ba907a3f1e3c77e187f82a0
              • Instruction Fuzzy Hash: 24E08C76600214BBC220EE5AEC42F9B776CEFC5714F40811AFA08A7241CAB5BA1187F4
              Function 00F62B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 48 f62b60-f62b6c LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 5452b824174745ed3df9c6f5d39a7b9f4c40ef95bb15c0f72a064d733aeb8e6e
              • Instruction ID: ca2b51e8be75aa6aa9ac3ca303d9967ac782de27cdc6eba758fa0199c8571047
              • Opcode Fuzzy Hash: 5452b824174745ed3df9c6f5d39a7b9f4c40ef95bb15c0f72a064d733aeb8e6e
              • Instruction Fuzzy Hash: E490026124240013520571588418616400A87E0341B55C033E1054590EC92989927126
              Function 00F62C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 49 f62c70-f62c7c LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 0ebffb57aaa6b640ba3380b5a29c1233b2ba5068aceb5f4be65d38a07b51c9ed
              • Instruction ID: 91ae6f459ce4739a81defcc8a54511ffff13000f16931655db04e959ffd34b20
              • Opcode Fuzzy Hash: 0ebffb57aaa6b640ba3380b5a29c1233b2ba5068aceb5f4be65d38a07b51c9ed
              • Instruction Fuzzy Hash: F790023124148812E2107158C40874A000587D0341F59C433A4464658E8A9989927122
              Function 00F62DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 50 f62df0-f62dfc LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 038a4add2bbf4409a0bde6e7631bcc886d1f4cd5b4a8ccb0bc6a87db12727333
              • Instruction ID: 286c91b374c4acc1743f07b80c5faaa198a5cb20f613d4ea1038a2b21997effc
              • Opcode Fuzzy Hash: 038a4add2bbf4409a0bde6e7631bcc886d1f4cd5b4a8ccb0bc6a87db12727333
              • Instruction Fuzzy Hash: 1990023124140423E21171588508707000987D0381F95C433A0464558E9A5A8A53B122
              Function 00F635C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 51 f635c0-f635cc LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: f8a4512265b8825241af12efdcadc6b47946802379c636cc0b1b217738924554
              • Instruction ID: d5086a026b55aae2355a1e5851894e7c8f7559757dd27543dcb075c04a85b7da
              • Opcode Fuzzy Hash: f8a4512265b8825241af12efdcadc6b47946802379c636cc0b1b217738924554
              • Instruction Fuzzy Hash: 9B90023164550412E20071588518706100587D0341F65C433A0464568E8B998A5275A3
              Function 0042C2F3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29memoryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 0 42c2f3-42c331 call 4044e3 call 42d1f3 RtlAllocateHeap
              APIs
              • RtlAllocateHeap.NTDLL(?,?,00000000,00000000,?,00000000,?,?,0042442F,?), ref: 0042C32C
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_400000_Payment TT Copy.jbxd
              Yara matches
              Similarity
              • API ID: AllocateHeap
              • String ID: /DB
              • API String ID: 1279760036-3231150706
              • Opcode ID: 82b667d971545224e14f2a0e876bad416e4c1c662e8abfd6be95cf47319361f2
              • Instruction ID: 1cc259c34e5a6671a29cdada009bc24d7596f140592599f984814b97bcb997af
              • Opcode Fuzzy Hash: 82b667d971545224e14f2a0e876bad416e4c1c662e8abfd6be95cf47319361f2
              • Instruction Fuzzy Hash: 0EE092B5604204BFD624EF59EC41FAB73ACEFC9710F004119F909A7242D670B91087B4
              Function 0042C333 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 29 42c333-42c374 call 4044e3 call 42d1f3 RtlFreeHeap
              APIs
              • RtlFreeHeap.NTDLL(00000000,00000004,00000000,8B104D8B,00000007,00000000,00000004,00000000,004169D1,000000F4), ref: 0042C36F
              Memory Dump Source
              • Source File: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_400000_Payment TT Copy.jbxd
              Yara matches
              Similarity
              • API ID: FreeHeap
              • String ID:
              • API String ID: 3298025750-0
              • Opcode ID: d14c62eb69cca364428996c5553d855d59e6f1fe04e10440ad974a44f14029f2
              • Instruction ID: e8459075e9a3333423ce965f69bc68c0ca0bfae673b190065d1dba1abb59a493
              • Opcode Fuzzy Hash: d14c62eb69cca364428996c5553d855d59e6f1fe04e10440ad974a44f14029f2
              • Instruction Fuzzy Hash: 13E09275200215BBC624EF49EC46FAB33ACEFC5710F004429FA08A7241D670BD1087B9
              Function 0042C383 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 39 42c383-42c3bc call 4044e3 call 42d1f3 ExitProcess
              APIs
              Memory Dump Source
              • Source File: 0000000D.00000002.2165031131.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_400000_Payment TT Copy.jbxd
              Yara matches
              Similarity
              • API ID: ExitProcess
              • String ID:
              • API String ID: 621844428-0
              • Opcode ID: f9a3a9da39839b5a70e0d25e6737cf736f2e68c13846871e79f2b581ccc73a83
              • Instruction ID: e44774924a6f467460c221681049be6fa39800156451224a620c0bb77a1e6b0d
              • Opcode Fuzzy Hash: f9a3a9da39839b5a70e0d25e6737cf736f2e68c13846871e79f2b581ccc73a83
              • Instruction Fuzzy Hash: 12E04F762002147BD120EA5ADC01F9B779CDFC5714F00441AFA0867241C6757A11C7A4
              Function 00F62C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 44 f62c0a-f62c0f 45 f62c11-f62c18 44->45 46 f62c1f-f62c26 LdrInitializeThunk 44->46
              APIs
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 8fccb285d828184e85ebb8b936c51f5cae89542b22bd01a4f05c00b5204b9ebb
              • Instruction ID: 68899cc31b5a56ed2593c464ff0ca0a10c685513407a1977f630d45fd903c02d
              • Opcode Fuzzy Hash: 8fccb285d828184e85ebb8b936c51f5cae89542b22bd01a4f05c00b5204b9ebb
              • Instruction Fuzzy Hash: A0B09B71D419C5D9EB51E760460C71B790067D0751F15C073D2070641F473CC5D1F176

              Non-executed Functions

              Function 00FA2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
              • API String ID: 0-2160512332
              • Opcode ID: 66c4657b1a15a5071a040f18194bd5978123d1df561b080311db96dd01584d3b
              • Instruction ID: 67d21cab7f8b529f3106c65bd97b042f415aa3a1eb661f59a9f2489e42e0935f
              • Opcode Fuzzy Hash: 66c4657b1a15a5071a040f18194bd5978123d1df561b080311db96dd01584d3b
              • Instruction Fuzzy Hash: BF92AEB1A08341AFD760CF28CC81B6BB7E8BB85764F04481DFA94D7291D774E944EB92
              Function 00F58620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
              Download Yara Rule
              Strings
              • Address of the debug info found in the active list., xrefs: 00F954AE, 00F954FA
              • Critical section address., xrefs: 00F95502
              • 8, xrefs: 00F952E3
              • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 00F954CE
              • Thread identifier, xrefs: 00F9553A
              • Thread is in a state in which it cannot own a critical section, xrefs: 00F95543
              • Critical section debug info address, xrefs: 00F9541F, 00F9552E
              • Critical section address, xrefs: 00F95425, 00F954BC, 00F95534
              • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 00F9540A, 00F95496, 00F95519
              • corrupted critical section, xrefs: 00F954C2
              • undeleted critical section in freed memory, xrefs: 00F9542B
              • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 00F954E2
              • Invalid debug info address of this critical section, xrefs: 00F954B6
              • double initialized or corrupted critical section, xrefs: 00F95508
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
              • API String ID: 0-2368682639
              • Opcode ID: 4e56c9b70262c2d3a3b008b2987fb08973c9b9b1e7a0a90c0ec77281dc9ba3d8
              • Instruction ID: 5181d5597e20949db0088fa8c2d0c16a8ad96aec4686ec9090a1dbebe64576a6
              • Opcode Fuzzy Hash: 4e56c9b70262c2d3a3b008b2987fb08973c9b9b1e7a0a90c0ec77281dc9ba3d8
              • Instruction Fuzzy Hash: 5781ABB1E00758AFEF20CF94C841BAEBBB5BB48B54F244019F944B7281C7B5A946EB51
              Function 00F529F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
              Download Yara Rule
              Strings
              • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 00F92412
              • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 00F925EB
              • @, xrefs: 00F9259B
              • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 00F92602
              • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 00F92624
              • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 00F92409
              • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 00F922E4
              • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 00F924C0
              • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 00F92498
              • RtlpResolveAssemblyStorageMapEntry, xrefs: 00F9261F
              • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 00F92506
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
              • API String ID: 0-4009184096
              • Opcode ID: ab0a2d5331799eeddf6942478315d65b7bda4e5c521841ca5e99a5261e767a53
              • Instruction ID: 2a6347292aa6a49bbc26d61525f86fccc19520816c2bd9b70f9fb505ea82e536
              • Opcode Fuzzy Hash: ab0a2d5331799eeddf6942478315d65b7bda4e5c521841ca5e99a5261e767a53
              • Instruction Fuzzy Hash: 000251F2D002289BEB61DB14CC85BDDB7B8AB45314F0441D9AB09A7242D735AE88EF59
              Function 00FC8B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
              • API String ID: 0-2515994595
              • Opcode ID: 46b5eee8f4152560c1e705b6a461122d2fe174d25abe9d0da2a101ae6ccb0a96
              • Instruction ID: 8a6b42acacf5b3d305778ede971d8ebc3c789a383a5bf9b5584b0a5f13f44ca4
              • Opcode Fuzzy Hash: 46b5eee8f4152560c1e705b6a461122d2fe174d25abe9d0da2a101ae6ccb0a96
              • Instruction Fuzzy Hash: 7D51D2715083569BC325DF188A46FABBBE8BFC43A0F10491DF99583281EB74D905E7A2
              Function 00FD0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
              • API String ID: 0-1700792311
              • Opcode ID: 815f780d0302b1e63a74ec8209f276ab159a72d8924b39d72b295d4af108be9c
              • Instruction ID: 4b626ce54d3b828ec90bfcd6522f3de371a2a637171a190a3eb6d02aa50603c5
              • Opcode Fuzzy Hash: 815f780d0302b1e63a74ec8209f276ab159a72d8924b39d72b295d4af108be9c
              • Instruction Fuzzy Hash: 82D18D35900685DFCB21DF68D841BA9BBF2FF4A720F1C815AE5459B362CB39D981EB10
              Function 00F2EA80 Relevance: 9.8, Strings: 7, Instructions: 1073COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T$`V${
              • API String ID: 0-2184846227
              • Opcode ID: 77b22a250e0864711442e666997606eb75bf14197c67e24da24c7b6053b3e4f6
              • Instruction ID: eaa7852b86e7598a2bd39bde13d5ef1dedcd3a8a8f20590ba72213a10f65c9c8
              • Opcode Fuzzy Hash: 77b22a250e0864711442e666997606eb75bf14197c67e24da24c7b6053b3e4f6
              • Instruction Fuzzy Hash: EEA25771E0562ACFDB64DF18DC987A9B7B1AF45314F2442E9D80DA7290DB34AE85EF00
              Function 00FA89B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
              Download Yara Rule
              Strings
              • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 00FA8A67
              • VerifierDlls, xrefs: 00FA8CBD
              • VerifierFlags, xrefs: 00FA8C50
              • AVRF: -*- final list of providers -*- , xrefs: 00FA8B8F
              • HandleTraces, xrefs: 00FA8C8F
              • VerifierDebug, xrefs: 00FA8CA5
              • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 00FA8A3D
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
              • API String ID: 0-3223716464
              • Opcode ID: 99989b758f5e73ec8fe9af6d2bb2198736d611eee38f68010bb763db45aca7e9
              • Instruction ID: 7aa16bdb0a2d1adf98ed85feb32cf1fe14165f6c6f8e17da8a07d60666b4a1c5
              • Opcode Fuzzy Hash: 99989b758f5e73ec8fe9af6d2bb2198736d611eee38f68010bb763db45aca7e9
              • Instruction Fuzzy Hash: 12911AF2A45711AFD721DF64CC81B5677A4AB877A0F040458F9816F281CBBDEC06EBA1
              Function 00F563FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
              • API String ID: 0-792281065
              • Opcode ID: f188b83bd1547894bca910b639ab3623a0ab715fa4b5bee3a1088e0026b94f6c
              • Instruction ID: 4f47c6af3de12723ab24ae27970e5c096c0bc2e65913d3bca9741c489e922043
              • Opcode Fuzzy Hash: f188b83bd1547894bca910b639ab3623a0ab715fa4b5bee3a1088e0026b94f6c
              • Instruction Fuzzy Hash: DC915371E003159BEF35DF14DC45BAA37A0BB52B24F540128FA50AB2C5DBBDA842F791
              Function 00F1645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
              Download Yara Rule
              Strings
              • Loading the shim user DLL failed with status 0x%08lx, xrefs: 00F79A2A
              • Building shim user DLL system32 filename failed with status 0x%08lx, xrefs: 00F799ED
              • minkernel\ntdll\ldrinit.c, xrefs: 00F79A11, 00F79A3A
              • apphelp.dll, xrefs: 00F16496
              • Getting the shim user exports failed with status 0x%08lx, xrefs: 00F79A01
              • LdrpInitShimEngine, xrefs: 00F799F4, 00F79A07, 00F79A30
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: Building shim user DLL system32 filename failed with status 0x%08lx$Getting the shim user exports failed with status 0x%08lx$LdrpInitShimuser$Loading the shim user DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
              • API String ID: 0-204845295
              • Opcode ID: 5496b7c600665f67f4fb654d1012c8580d4f6222c563b69a09eef23a9ba9589a
              • Instruction ID: a3b48483bbdb824f4545b482698de40a26cb0d9c627008823eb7e8db6c5474db
              • Opcode Fuzzy Hash: 5496b7c600665f67f4fb654d1012c8580d4f6222c563b69a09eef23a9ba9589a
              • Instruction Fuzzy Hash: 7051EF712083049FE321DF24DC82BAB77E5FB84754F10491AF5899B1A1DB78E944EB93
              Function 00F5C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
              Download Yara Rule
              Strings
              • LdrpInitializeProcess, xrefs: 00F5C6C4
              • minkernel\ntdll\ldrredirect.c, xrefs: 00F98181, 00F981F5
              • Loading import redirection DLL: '%wZ', xrefs: 00F98170
              • minkernel\ntdll\ldrinit.c, xrefs: 00F5C6C3
              • Unable to build import redirection Table, Status = 0x%x, xrefs: 00F981E5
              • LdrpInitializeImportRedirection, xrefs: 00F98177, 00F981EB
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
              • API String ID: 0-475462383
              • Opcode ID: 51ae99bc08f035c9435cd65063278f31306c40c1810de9dfd95e510bee6dc6e3
              • Instruction ID: 3014c8376e53223da851a518ab16dff56f20168db32aa76ab7eab0d34b76f6df
              • Opcode Fuzzy Hash: 51ae99bc08f035c9435cd65063278f31306c40c1810de9dfd95e510bee6dc6e3
              • Instruction Fuzzy Hash: F93118717443059FD320EF28DD46E2A7794FF85B20F040528FD85AB2D2DA68ED05E7A2
              Function 00F52674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
              Download Yara Rule
              Strings
              • RtlGetAssemblyStorageRoot, xrefs: 00F92160, 00F9219A, 00F921BA
              • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 00F92178
              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 00F921BF
              • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 00F92180
              • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 00F9219F
              • SXS: %s() passed the empty activation context, xrefs: 00F92165
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
              • API String ID: 0-861424205
              • Opcode ID: 50e516ba6ae21d43d1c2dc44d310a0694b626451a809fc6ca24352e3736609ae
              • Instruction ID: 54f66781062102f67d4c06c5856a106ffae213a4793c27f2910275f87f784e0a
              • Opcode Fuzzy Hash: 50e516ba6ae21d43d1c2dc44d310a0694b626451a809fc6ca24352e3736609ae
              • Instruction Fuzzy Hash: 5F313536F00324B7FB21DA949C85F5E76B8DB66B51F1541A9BF04AB281D270EE40F3A1
              Function 00F6096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
              Download Yara Rule
              APIs
                • Part of subcall function 00F62DF0: LdrInitializeThunk.NTDLL ref: 00F62DFA
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F60BA3
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F60BB6
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F60D60
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F60D74
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
              • String ID:
              • API String ID: 1404860816-0
              • Opcode ID: d69d684f7cccff33307ca993de6f59e9ae6ba3c63b6f64f224c837c3c68ef767
              • Instruction ID: 8d463d23a03e77d3574a242bdd78eaf00d23486ce9673d91b5be959cfead21a3
              • Opcode Fuzzy Hash: d69d684f7cccff33307ca993de6f59e9ae6ba3c63b6f64f224c837c3c68ef767
              • Instruction Fuzzy Hash: CE425A719007159FDB20CF68C881BAAB7F4FF44310F1445AEE999EB241EB75AA84DF60
              Function 00F2A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
              • API String ID: 0-379654539
              • Opcode ID: 0c170997b41f75e284ecdc0afc1be6f3cfa5051a64771f24fa3048e1e29371f2
              • Instruction ID: ec8abebaf14597941fed2d8588042e7701399d6777867ac66222c2de56b1cf2a
              • Opcode Fuzzy Hash: 0c170997b41f75e284ecdc0afc1be6f3cfa5051a64771f24fa3048e1e29371f2
              • Instruction Fuzzy Hash: 73C1CA71508392CFC711EF18D540BAAB7E4FF84714F04496AF8858B261E778DA49EB53
              Function 00F58402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
              Download Yara Rule
              Strings
              • LdrpInitializeProcess, xrefs: 00F58422
              • minkernel\ntdll\ldrinit.c, xrefs: 00F58421
              • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 00F5855E
              • @, xrefs: 00F58591
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
              • API String ID: 0-1918872054
              • Opcode ID: 9654aee7a81f5154bfe9288fc9da336ca214597365ba41e85b5880927be43b08
              • Instruction ID: 51355b808efa3f0feb15476a75733be120edd5467c0c72f85b17308a3c1ef5d8
              • Opcode Fuzzy Hash: 9654aee7a81f5154bfe9288fc9da336ca214597365ba41e85b5880927be43b08
              • Instruction Fuzzy Hash: 8491AD71508744AFD721DF20CC41F6BB7E8FF847A5F44092EFA84A2151EB38D949AB62
              Function 00F5273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
              Download Yara Rule
              Strings
              • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 00F921D9, 00F922B1
              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 00F922B6
              • .Local, xrefs: 00F528D8
              • SXS: %s() passed the empty activation context, xrefs: 00F921DE
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
              • API String ID: 0-1239276146
              • Opcode ID: 0e293d820ab486d27f79a52cd98c138fef7cfd42ba1e89c00a32f324d9076e7f
              • Instruction ID: 5ae16cffa50e1afe1fb062b4cf0bd64352c2706ac6c84ba1f1c82b94cb6977e5
              • Opcode Fuzzy Hash: 0e293d820ab486d27f79a52cd98c138fef7cfd42ba1e89c00a32f324d9076e7f
              • Instruction Fuzzy Hash: 1AA1A035D002299BDB64CF54DC84BA9B3B1BF59325F2442EADD08AB351D7349E84EF90
              Function 00F54AD0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON
              Download Yara Rule
              Strings
              • SXS: %s() called with invalid flags 0x%08lx, xrefs: 00F9342A
              • RtlDeactivateActivationContext, xrefs: 00F93425, 00F93432, 00F93451
              • SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 00F93437
              • SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 00F93456
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
              • API String ID: 0-1245972979
              • Opcode ID: 4a96ceee890a5ea39e995890a8c4148580a5a20848975cc68e6a4257a9d51169
              • Instruction ID: bb8bd7bd6f0b6b2c583e55a94f4f494db95ecb4fd9dc2b2c5744056b1799897a
              • Opcode Fuzzy Hash: 4a96ceee890a5ea39e995890a8c4148580a5a20848975cc68e6a4257a9d51169
              • Instruction Fuzzy Hash: D9616732A44B11ABDB22CF18C846B2AB3E1EF80B65F158129FD559B280C774FD44FB91
              Function 00F264AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
              Download Yara Rule
              Strings
              • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 00F80FE5
              • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 00F810AE
              • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 00F81028
              • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 00F8106B
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
              • API String ID: 0-1468400865
              • Opcode ID: c9d90442fbf02225d5d40cfa924865dcb5ca64cc245d5a5b936ae5926db4c49f
              • Instruction ID: d3e53ae3d920366898c6935f0deb75c2f8bb07c5ea32ecb94e4a4890232b3e19
              • Opcode Fuzzy Hash: c9d90442fbf02225d5d40cfa924865dcb5ca64cc245d5a5b936ae5926db4c49f
              • Instruction Fuzzy Hash: 1271E3B19043149FCB20EF14CC86B977FA8EF94764F444468F9498B186D738D589EBD2
              Function 00F4245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrinit.c, xrefs: 00F8A9A2
              • TG, xrefs: 00F42462
              • LdrpDynamicShimModule, xrefs: 00F8A998
              • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 00F8A992
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$TG$minkernel\ntdll\ldrinit.c
              • API String ID: 0-2078120800
              • Opcode ID: b980161405e0211dd7096f20b09bf4cf311088013203d72553e1d282379e62b0
              • Instruction ID: b8259f9dab2af43be42b38cbe07b4cb99f570c67143d6d9774f9be1315b44930
              • Opcode Fuzzy Hash: b980161405e0211dd7096f20b09bf4cf311088013203d72553e1d282379e62b0
              • Instruction Fuzzy Hash: 66314F72A00301EBE734EF58DC45AA9BBB4FB84724F56406AFC406B255C7BD9D41E741
              Function 00F329A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
              Download Yara Rule
              Strings
              • HEAP[%wZ]: , xrefs: 00F33255
              • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 00F3327D
              • HEAP: , xrefs: 00F33264
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
              • API String ID: 0-617086771
              • Opcode ID: f65bc2a50180db2cbd902dd62a1d59067313029dcdb63b5a4dfec7c16615df1f
              • Instruction ID: 9a45d178877432839145262b13db33e3270c56bbf6b821efc6711584f5ac4006
              • Opcode Fuzzy Hash: f65bc2a50180db2cbd902dd62a1d59067313029dcdb63b5a4dfec7c16615df1f
              • Instruction Fuzzy Hash: 9692BC71E042489FDB25CF68C840BAEBBF1FF48320F188059E845AB391D739AA45EF50
              Function 00F30770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
              • API String ID: 0-4253913091
              • Opcode ID: 1a99c2c5ba1e3bc5a776072347cb86f99aae961d64d929c22df00ea1a259e70c
              • Instruction ID: 77a13c7aeade3bb15235225d9ea9dd4ebf1baa92c42d6e4b6493ad797257159c
              • Opcode Fuzzy Hash: 1a99c2c5ba1e3bc5a776072347cb86f99aae961d64d929c22df00ea1a259e70c
              • Instruction Fuzzy Hash: 3BF1BF31A00A05DFDB25DF68C894BAAB7B5FF44724F144169E4069B392DB34ED81EB90
              Function 00F46962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: $@
              • API String ID: 0-1077428164
              • Opcode ID: 942d05e5efacadfddf1eab25907fb958108ac463580cc79eab25806eb9748e2e
              • Instruction ID: 7edc3b796388c5d61e39b95ebee8a89b6e1b0b2f83dd4bdbcf9e585ed1698469
              • Opcode Fuzzy Hash: 942d05e5efacadfddf1eab25907fb958108ac463580cc79eab25806eb9748e2e
              • Instruction Fuzzy Hash: BBC29F72A0C3419FD725DF24C881BABBBE5AF88754F14892DF989C7241D734D805EBA2
              Function 00F1A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: FilterFullPath$UseFilter$\??\
              • API String ID: 0-2779062949
              • Opcode ID: 7cc35ae1875f1e0b9a079a146b88c97e372d628c1aec0147e48986ab3b1bec1a
              • Instruction ID: 395dbeec87a51a115ad99519a6ae303345c26c3cef2294b8d523fd6116c1cfc6
              • Opcode Fuzzy Hash: 7cc35ae1875f1e0b9a079a146b88c97e372d628c1aec0147e48986ab3b1bec1a
              • Instruction Fuzzy Hash: 49A15971D016299BDB21DF64CC89BEAB7B8EF48710F1041EAE90CA7250D7399E84DF91
              Function 00F40BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
              Download Yara Rule
              Strings
              • Failed to allocated memory for shimmed module list, xrefs: 00F8A10F
              • minkernel\ntdll\ldrinit.c, xrefs: 00F8A121
              • LdrpCheckModule, xrefs: 00F8A117
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
              • API String ID: 0-161242083
              • Opcode ID: d8a8944467fb52f1e66945b67572294bc110376ce12f1118f7337c135b1e3206
              • Instruction ID: a65eb3001795851f10e7f449cfb88ce1689cfb61ffdb71b910aa773a0ccab96c
              • Opcode Fuzzy Hash: d8a8944467fb52f1e66945b67572294bc110376ce12f1118f7337c135b1e3206
              • Instruction Fuzzy Hash: 3471E071E00205DBDB24EF68CC81AAEBBF0FB44714F14416DEA42AB241EA79AD41EB41
              Function 00F30A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
              • API String ID: 0-1334570610
              • Opcode ID: f9930c4109509243afbcf77aa21321ca0521b2a4850ad98e3d057ee592f6faeb
              • Instruction ID: 9f881bedde9a1920034f789666aa7f264e7593be16519a3cadda3b9736662174
              • Opcode Fuzzy Hash: f9930c4109509243afbcf77aa21321ca0521b2a4850ad98e3d057ee592f6faeb
              • Instruction Fuzzy Hash: B761F331600705DFDB28DF28C851BAABBE1FF45724F24846AE445CF292CB74E881EB91
              Function 00F5C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
              Download Yara Rule
              Strings
              • LdrpInitializePerUserWindowsDirectory, xrefs: 00F982DE
              • minkernel\ntdll\ldrinit.c, xrefs: 00F982E8
              • Failed to reallocate the system dirs string !, xrefs: 00F982D7
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
              • API String ID: 0-1783798831
              • Opcode ID: 85328ace17725b01729662e8cbe2be297e1f82617f4a16d8374a2df78da6a7a5
              • Instruction ID: 1f8625f30f10030afe6efb317004d9b5362ff2968957ba21804cda5788eaf841
              • Opcode Fuzzy Hash: 85328ace17725b01729662e8cbe2be297e1f82617f4a16d8374a2df78da6a7a5
              • Instruction Fuzzy Hash: C641D372904300ABD720EB24EC45B5B77E8EB49B60F00492AFE85D7291EB7DD804AB91
              Function 00FDC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
              Download Yara Rule
              Strings
              • PreferredUILanguages, xrefs: 00FDC212
              • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 00FDC1C5
              • @, xrefs: 00FDC1F1
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
              • API String ID: 0-2968386058
              • Opcode ID: 741d12326dee7607df377475ffee5a15325905e300ad65a1563daf89978f4dc5
              • Instruction ID: 68a71b6ab19ce7ec50d17337e18f55b9a22426ab92f65625f63d19a6cad1c8d7
              • Opcode Fuzzy Hash: 741d12326dee7607df377475ffee5a15325905e300ad65a1563daf89978f4dc5
              • Instruction Fuzzy Hash: 5A416D72E0021AEBDB11DAD4C881BEEB7BAAB54711F18416BE905B7280D7749E44EB90
              Function 00FB4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
              • API String ID: 0-1373925480
              • Opcode ID: e8731415da5c1f631af95319b8a89847cba3f5d7c43c7227d338e28b2527ff9b
              • Instruction ID: 28a7dcfedc163f5425b5acb313c1037f648870101621be7ea959c2937c3b9f47
              • Opcode Fuzzy Hash: e8731415da5c1f631af95319b8a89847cba3f5d7c43c7227d338e28b2527ff9b
              • Instruction Fuzzy Hash: FB41E172D046588BEB22DB9ACA40BEDB7B4EF55350F240469E801EB792D638A941FF11
              Function 00FA4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
              Download Yara Rule
              Strings
              • minkernel\ntdll\ldrredirect.c, xrefs: 00FA4899
              • LdrpCheckRedirection, xrefs: 00FA488F
              • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 00FA4888
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
              • API String ID: 0-3154609507
              • Opcode ID: 1d1ee8e6b7b7b89445da6700f5a174988a8acc7a344b580d16d1618ccfe6573a
              • Instruction ID: 9fd748c13fa514e6c76be5093acd7b176dbc6c2528f6c08483c6eb1655829e37
              • Opcode Fuzzy Hash: 1d1ee8e6b7b7b89445da6700f5a174988a8acc7a344b580d16d1618ccfe6573a
              • Instruction Fuzzy Hash: 1041D3B2A043909FCB21CE18E840A2677E4BFCAB60B150269EC95D7251D3B9FC00EB91
              Function 00F2A2C3 Relevance: 3.9, Strings: 3, Instructions: 118COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: PS$RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
              • API String ID: 0-405261330
              • Opcode ID: 13d873a1519713f4fb376bb6f17c254eab5f031b951a1764ce720980e933a833
              • Instruction ID: 1e6094d3adb67d4d9c67df694b4827302b722baa1defb4aab6850eec6e3a3da6
              • Opcode Fuzzy Hash: 13d873a1519713f4fb376bb6f17c254eab5f031b951a1764ce720980e933a833
              • Instruction Fuzzy Hash: 0141CF31A05669DFDB11DF59D840BAE77B4FF85720F2440A5E800DB292E37AEE00EB51
              Function 00F30BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
              • API String ID: 0-2558761708
              • Opcode ID: 7c23e038662441a049379ced340770dd486ed5c6a781bf3315a91bf3c4ea818c
              • Instruction ID: bb2c783be1ca54c014a5cd387ee1648e9aa6cd22247a5fd7ed9794d6b43e7eaa
              • Opcode Fuzzy Hash: 7c23e038662441a049379ced340770dd486ed5c6a781bf3315a91bf3c4ea818c
              • Instruction Fuzzy Hash: 9111B132315941DFDB28EA14C861BB6F3A5EF90B36F24816AE406CB651DB38DCC1E751
              Function 00FA20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
              Download Yara Rule
              Strings
              • LdrpInitializationFailure, xrefs: 00FA20FA
              • minkernel\ntdll\ldrinit.c, xrefs: 00FA2104
              • Process initialization failed with status 0x%08lx, xrefs: 00FA20F3
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
              • API String ID: 0-2986994758
              • Opcode ID: a43e6a28b04dc213edd5d57e1c910856e9278e869353622233e40b51e0bdd442
              • Instruction ID: f9a15531d69986b6146ebaa2582c4f577f4a89e17accfd46d618a2c8cd5261fc
              • Opcode Fuzzy Hash: a43e6a28b04dc213edd5d57e1c910856e9278e869353622233e40b51e0bdd442
              • Instruction Fuzzy Hash: EBF0C875A403086BD734E64CDC47F953768FB42B68F500059F6407B2C1D5B9A940E651
              Function 00F303E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: #%u
              • API String ID: 48624451-232158463
              • Opcode ID: 07640d799356bb171550d0a3cf48f704bc7552645fff0f1efb88bca699c78016
              • Instruction ID: 4b45aa756709f349e706ec3ed76f0258e82dcafc08ddf4338775210506ee6340
              • Opcode Fuzzy Hash: 07640d799356bb171550d0a3cf48f704bc7552645fff0f1efb88bca699c78016
              • Instruction Fuzzy Hash: 6C714972E0014A9FDB01DFA8D991BAEB7F8AF08714F144065E905E7252EA38EE01DB60
              Function 00F2C7C0 Relevance: 3.5, Strings: 2, Instructions: 960COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: MUI$\U
              • API String ID: 0-3971960151
              • Opcode ID: c549f20feab64eeb0a73309be99de99103476d672dfbfa4d3c6d7752592ee791
              • Instruction ID: cb2271159d553c9d7b931a987cd34bb891c73c30dc3c3ddf56aedf1eeac8256c
              • Opcode Fuzzy Hash: c549f20feab64eeb0a73309be99de99103476d672dfbfa4d3c6d7752592ee791
              • Instruction Fuzzy Hash: 14824C75E002288FDB24CFA9D980BEDB7B5FF48710F248169E859AB291D7349D41EF90
              Function 00F2A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
              Download Yara Rule
              Strings
              • LdrResSearchResource Enter, xrefs: 00F2AA13
              • LdrResSearchResource Exit, xrefs: 00F2AA25
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
              • API String ID: 0-4066393604
              • Opcode ID: c41194dcc5500336701b79503b532e11f3fdab5ec93475a2964e561acf03a032
              • Instruction ID: 69b4fbc18db534c34520a9b9cf8059db36420a439101daa571fbd150b865c8f9
              • Opcode Fuzzy Hash: c41194dcc5500336701b79503b532e11f3fdab5ec93475a2964e561acf03a032
              • Instruction Fuzzy Hash: 1EE18D72E00228EFEB21DE99DA84BEEB7B9EF54724F104026F901E7251D7389D40EB51
              Function 00FEA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: `$`
              • API String ID: 0-197956300
              • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
              • Instruction ID: 69fefc31693ac547873e39baefbd151a334b94fab9adc81baa5a9d4b6044b579
              • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
              • Instruction Fuzzy Hash: 6CC1F2316043819BDB24CF2AC841B2BBBE5FFC4364F184A2DF595CA291D778E905EB52
              Function 00F9E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID: Legacy$UEFI
              • API String ID: 2994545307-634100481
              • Opcode ID: 99f01e9f2dff083f04f3e98cba5389583cb45628a6d139ea61407f2bd763c93b
              • Instruction ID: 117a61acb6888545a64c075e48a1de6c6c12582752796b3f1734f0bf72b2d6ff
              • Opcode Fuzzy Hash: 99f01e9f2dff083f04f3e98cba5389583cb45628a6d139ea61407f2bd763c93b
              • Instruction Fuzzy Hash: 48615C72E006189FEF14DFA8C841BADBBB5FB48700F20406DE659EB291D731A944EB51
              Function 00FC43D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: @$MUI
              • API String ID: 0-17815947
              • Opcode ID: 0bd4494d5f2f84129bfb14a6f600a6d9f85c5a177d8863f20b6b7a5a7d308424
              • Instruction ID: 94b02ea5d22d5dd9f906e0cea085d20f971a296fed6b11d3dba07c6503a61dff
              • Opcode Fuzzy Hash: 0bd4494d5f2f84129bfb14a6f600a6d9f85c5a177d8863f20b6b7a5a7d308424
              • Instruction Fuzzy Hash: 20514971E0061DAFDB11DFA4CD91FEEBBB8EB44754F140529E900B7280D635AE05DB60
              Function 00F204E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
              Download Yara Rule
              Strings
              • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 00F2063D
              • kLsE, xrefs: 00F20540
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
              • API String ID: 0-2547482624
              • Opcode ID: 0cde67251c68b0e20fb80dd5e635daf5cf3c1cc5f1a7ee52d1081dba38881943
              • Instruction ID: 065b3d3ac177def1737046d728ff563bf5f43f8344d20b0493dc79e45b910195
              • Opcode Fuzzy Hash: 0cde67251c68b0e20fb80dd5e635daf5cf3c1cc5f1a7ee52d1081dba38881943
              • Instruction Fuzzy Hash: 0F51EF729047568FC724EF64E4456A3BBE4EF84310F04883EE9DA87242EB74E945DF92
              Function 00F5A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID: Cleanup Group$Threadpool!
              • API String ID: 2994545307-4008356553
              • Opcode ID: 933bca28645befb9cbdb3c0905abca93ea870d72362b570dbe2bbde88aa02ea3
              • Instruction ID: 366bd8d44582826eaf8cfaaff2cce588c1263e1b333ad3f71a989e92a54b6ae1
              • Opcode Fuzzy Hash: 933bca28645befb9cbdb3c0905abca93ea870d72362b570dbe2bbde88aa02ea3
              • Instruction Fuzzy Hash: 6401D1B2240B04AFD311DF24CD46B2677E8E784716F058A39BA58C7190E778D818DB46
              Function 00FA6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID: 0-3916222277
              • Opcode ID: 22281fd7375ad232641cf2f7cb6f75ecc921813f1d223f5ff20b3711a9e11898
              • Instruction ID: 1ac8ee77697d48f387ac37ecb627898cb48100dd44e18002fc7167ebebd3e85c
              • Opcode Fuzzy Hash: 22281fd7375ad232641cf2f7cb6f75ecc921813f1d223f5ff20b3711a9e11898
              • Instruction Fuzzy Hash: 9C9163B2940619AFDB21DF95DD85FAEBBB8EF09B50F140065F600EB291D774AD00DBA0
              Function 00FCE10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID: 0-3916222277
              • Opcode ID: 2963adb5de302e80b6817deb5ca03ae7369a836926ab53719dbe064f8eb26d1a
              • Instruction ID: 8602abc3ed860fdf821f832b55b229104e66518ec04d0eb7a129d5d8ee475761
              • Opcode Fuzzy Hash: 2963adb5de302e80b6817deb5ca03ae7369a836926ab53719dbe064f8eb26d1a
              • Instruction Fuzzy Hash: DC91B032D0064ABBDB22AFA5DD46FEFBB79EF85750F100029F501A7251DB38A905EB50
              Function 00F5A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: GlobalTags
              • API String ID: 0-1106856819
              • Opcode ID: 234269b2febedb003a2a7d4de908329ff29423d1d7dc83a35490e17a1878cc34
              • Instruction ID: d3a699e5fb51bad6326a063d0c3985ad7fb6bd2ed9f089466203853a6954802e
              • Opcode Fuzzy Hash: 234269b2febedb003a2a7d4de908329ff29423d1d7dc83a35490e17a1878cc34
              • Instruction Fuzzy Hash: CC719F75E0020ADFEF28DF98D991AADBBB1BF48714F24812EE805E7241DB359D41EB50
              Function 00FC4978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: .mui
              • API String ID: 0-1199573805
              • Opcode ID: 5641dd18176fceec4eea12f912ad28eabee3a2e027b684857b1b6c81931b367f
              • Instruction ID: 6f6ab92ed771a25efc8d382e5683c1a574c01f6831e37218d351b43b2b27add5
              • Opcode Fuzzy Hash: 5641dd18176fceec4eea12f912ad28eabee3a2e027b684857b1b6c81931b367f
              • Instruction Fuzzy Hash: 71518172D0022ADBCF10DF99DA51FAEB7B4AF44B50F05412DE911BB251D738AD01EBA4
              Function 00F3E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: EXT-
              • API String ID: 0-1948896318
              • Opcode ID: a06456944d9cea9fbade4cefc5282c9b517821b301c49f667bc0d614f6062a4b
              • Instruction ID: 5b2465748deac3ad71c0518a0f33d44a2947d78d62fbff2a16f0449d1349bf3d
              • Opcode Fuzzy Hash: a06456944d9cea9fbade4cefc5282c9b517821b301c49f667bc0d614f6062a4b
              • Instruction Fuzzy Hash: 4241A1729083159BD720DA74C841BAFB7E8AF88B24F04092DF994E71C1EB78DD04E796
              Function 00F9C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: BinaryHash
              • API String ID: 0-2202222882
              • Opcode ID: d5a8ceecd2a7a99df1e125e224f2cef7630ef40b4840cae08ef54c1d097273a0
              • Instruction ID: 88d5fa272dcf2b2e743a85ecf4da3aaf3f1a61fb7cd969767ea949127ff1e3fa
              • Opcode Fuzzy Hash: d5a8ceecd2a7a99df1e125e224f2cef7630ef40b4840cae08ef54c1d097273a0
              • Instruction Fuzzy Hash: 704162B1D0052CAAEF21DA60CC85FDEB77CAB44754F0045A5EA08AB181DB749E899FE4
              Function 00FB6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: #
              • API String ID: 0-1885708031
              • Opcode ID: f6cccf98b1166527f6d0a8f9127843f06d7f87cef479376ca325f16a5c99736e
              • Instruction ID: cbf004dc6da5d7f614fa67249dc6bea00686d24775a2304eb1d808dafc75739c
              • Opcode Fuzzy Hash: f6cccf98b1166527f6d0a8f9127843f06d7f87cef479376ca325f16a5c99736e
              • Instruction Fuzzy Hash: 16311671A007189ADB21DB6ACC51BEE7BB8DF45715F104028E981EB282CB7DEC05EF50
              Function 00F9CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: BinaryName
              • API String ID: 0-215506332
              • Opcode ID: d3aea4e2cdf1f57cce0292193330dde15f13511f93cd87b7bc75357450a7d7f1
              • Instruction ID: 292aeaf3b047f8b278fcf777931064eb12a652c33d8fc2258e6798d8b4a46171
              • Opcode Fuzzy Hash: d3aea4e2cdf1f57cce0292193330dde15f13511f93cd87b7bc75357450a7d7f1
              • Instruction Fuzzy Hash: 5631DD76D00619AFEF15DE58C856E6FBBB4EBC0760F114129A805A7291D730AE04EBE0
              Function 00FA892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
              Download Yara Rule
              Strings
              • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 00FA895E
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
              • API String ID: 0-702105204
              • Opcode ID: 4da55156b0c67918853285f6e1eabc6708ca9edc50c737c7601581573a4eec7a
              • Instruction ID: 7c7c73ef01ee376166e9e9077e99acf1ea84c64bc41079a5b52ecb2da3646091
              • Opcode Fuzzy Hash: 4da55156b0c67918853285f6e1eabc6708ca9edc50c737c7601581573a4eec7a
              • Instruction Fuzzy Hash: A701F7B26102109BD6206A55DC85AB77B65EFCFBE0F140028F5810A556CFADAC83F792
              Function 00FC2000 Relevance: .8, Instructions: 757COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e7e8924f69322beabe2845bb7665250a82a403f563212d0c3df7798fb136f83d
              • Instruction ID: bf3ef408b5cb2ad72f15f07586e92b895222a7d47b2bde15482459747b11e745
              • Opcode Fuzzy Hash: e7e8924f69322beabe2845bb7665250a82a403f563212d0c3df7798fb136f83d
              • Instruction Fuzzy Hash: 5442D432A083428BD765CF68C992F6BB7E5EF88710F18092EF98197290D774DC45EB52
              Function 00FB8158 Relevance: .6, Instructions: 617COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0ee902c0c0ed8ca5b7a536a46805a76151b2b8a5104e633bb94bac3f3b4a5de2
              • Instruction ID: a7fb2276252714f730bfaeeac5de7a37ff2ae4dba35f8db517244a0527eeed13
              • Opcode Fuzzy Hash: 0ee902c0c0ed8ca5b7a536a46805a76151b2b8a5104e633bb94bac3f3b4a5de2
              • Instruction Fuzzy Hash: D8423C75E002198FDB24CF69C881BEDB7F9BF88750F188199E849AB241DB349D86DF50
              Function 00F32840 Relevance: .6, Instructions: 605COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dcda80f1c65c08e7d8314ec67cb213b5905094096402bb5d3d0eca174b5ae624
              • Instruction ID: d3135c6f35651d53f07580cea01e603eecb2c16781edeb3853c3ae1067fcbff4
              • Opcode Fuzzy Hash: dcda80f1c65c08e7d8314ec67cb213b5905094096402bb5d3d0eca174b5ae624
              • Instruction Fuzzy Hash: 5432CF70A007558FDB24EF69C8457BEBBF2BF84314F24411DE48ADB285DB39A842EB50
              Function 00FCA118 Relevance: .6, Instructions: 591COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a500fead3dbae41c28a66e93b41cdb6cf8384d3782a8adb481536ade2182f3b2
              • Instruction ID: dd0121fd393d071cd85001eb57f75175cc8db42920a9dab80642e2b9896fd48e
              • Opcode Fuzzy Hash: a500fead3dbae41c28a66e93b41cdb6cf8384d3782a8adb481536ade2182f3b2
              • Instruction Fuzzy Hash: F722F471A0465A8BD724CF29C252B72B7F1BF44318F18849DD8968F285D335F852FB62
              Function 00F26A50 Relevance: .5, Instructions: 548COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 511cb88c68fd71d12a6e4f3747d57b6296cee12241aa6db19df8e75f27514aac
              • Instruction ID: 7fe589d92fb26f38e77f0fa8af9871a78aeef7544132ff31cfd809e22c56dfb3
              • Opcode Fuzzy Hash: 511cb88c68fd71d12a6e4f3747d57b6296cee12241aa6db19df8e75f27514aac
              • Instruction Fuzzy Hash: 95327B71A05618CFCB24DFA8D880BAAB7F5FF48310F248669E955EB391D734AC41EB50
              Function 00F44A35 Relevance: .4, Instructions: 423COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
              • Instruction ID: 8fdf35345198f63d90869c8523650536940b1f5bf5a247da2ee87ceccab1cd17
              • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
              • Instruction Fuzzy Hash: 6BF14B71E0161A9BDB14DF95C980BAEBBB5BF48714F088129ED05BB241E774EC42EB60
              Function 00FB892B Relevance: .4, Instructions: 386COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b72d520a3dbed15565c9bbf375b2e4cc5f8b3cac8dc7310716afcadad7b1ccbc
              • Instruction ID: 17ef0a30416f9a6daf164b2805d81266183ae9d339ed7bc3384971a57eeefa86
              • Opcode Fuzzy Hash: b72d520a3dbed15565c9bbf375b2e4cc5f8b3cac8dc7310716afcadad7b1ccbc
              • Instruction Fuzzy Hash: C5D1D471E006199BDF04CF6AC841BFEB7B9AFC8354F18816AD455E7280DB39A906DB60
              Function 00F265D0 Relevance: .4, Instructions: 383COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fe96676950fcbb7199092e3daed0f4b9a5bfd9a0be83452b6d74c8b2e543ea70
              • Instruction ID: aa4e7f2c5e888e480d5618548dff45b3441956998116be61db89fc936c1b1fa6
              • Opcode Fuzzy Hash: fe96676950fcbb7199092e3daed0f4b9a5bfd9a0be83452b6d74c8b2e543ea70
              • Instruction Fuzzy Hash: 33E19A71908351CFC714CF28D490A6ABBE0FF99328F148A6DE899CB351DB31E945DB92
              Function 00F18397 Relevance: .4, Instructions: 380COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4e99508090b19b35cb6068b2b7a1a5b346a5a0dcd4eede8ec46f2a50fffc0a8f
              • Instruction ID: 422e3d0d11ec92048d2422a117b8181b115852fb283baef5c4c27ee8312bd077
              • Opcode Fuzzy Hash: 4e99508090b19b35cb6068b2b7a1a5b346a5a0dcd4eede8ec46f2a50fffc0a8f
              • Instruction Fuzzy Hash: 48D1E172A002169BCB14CF24CD91BFA73A5BF55364F14822AF916DB2C1EF34D982EB51
              Function 00FA8243 Relevance: .3, Instructions: 322COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
              • Instruction ID: 268499af5b40383fc6ce5bf275e7cfc8cec2420d1b6686e1d56d7e0b38362aed
              • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
              • Instruction Fuzzy Hash: D9B180B4E00604AFDF24DB94C940BABBBB9AF85394F144429A94297791DEB4ED06EB10
              Function 00F30535 Relevance: .3, Instructions: 300COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
              • Instruction ID: 372293ac644976d27a682b0a0f0e1faefb4a52435e43f942ffcae46630e9dd14
              • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
              • Instruction Fuzzy Hash: 48B1F731A04646AFDB15DB68C851BBEBBF6AF44320F18016AE552D7381DB34ED41FB90
              Function 00F283C0 Relevance: .3, Instructions: 281COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 12f4b017f720f77a9b8f8fee2377e8bd1cc31e8067a01e1669818632dcbd6010
              • Instruction ID: 380145dbcb6636046859feef384dd462ee11988eb11c31ce30c9e0a744582dfd
              • Opcode Fuzzy Hash: 12f4b017f720f77a9b8f8fee2377e8bd1cc31e8067a01e1669818632dcbd6010
              • Instruction Fuzzy Hash: 52C178716083408FD760DF14C495BABB7E8FF88354F44492DE98987290DB78E909DF92
              Function 00F1C427 Relevance: .3, Instructions: 280COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f040e72387896fb421f48aab9e267ed8377a262c6e84e743c8ff39b85d35cc9b
              • Instruction ID: f385a3bcdde2b4b7c51900a9ceb77c94942a0d9d5f57fa5ceb9512530172ac34
              • Opcode Fuzzy Hash: f040e72387896fb421f48aab9e267ed8377a262c6e84e743c8ff39b85d35cc9b
              • Instruction Fuzzy Hash: AFB17170A402658BDB24DF54C890BEDB3B2EF84710F1585EAD40AE7281EB74ADC5EF61
              Function 00F4E5E7 Relevance: .3, Instructions: 278COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 16aee5d41ea9141b87aa70c09b68d52fa498d7a91f37a19fee3144253f991014
              • Instruction ID: 775e5b692b16d26d71c723face14f6c5c15f524b0aeb91bc2cc3d21da5b9364d
              • Opcode Fuzzy Hash: 16aee5d41ea9141b87aa70c09b68d52fa498d7a91f37a19fee3144253f991014
              • Instruction Fuzzy Hash: A8A10532E006189FDB21EB98CC44BEEBBA4BF41724F150165ED50AB2D1D77C9E44EB91
              Function 00F60185 Relevance: .3, Instructions: 276COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0f68dd8d220dade0bbf1a3f77eb584ed8a6fb8e7f77aed8d2912d5e4c43f76cc
              • Instruction ID: 3b7ade75dbf16d62d00362052f349da881c32379923e5408309265102a1b0194
              • Opcode Fuzzy Hash: 0f68dd8d220dade0bbf1a3f77eb584ed8a6fb8e7f77aed8d2912d5e4c43f76cc
              • Instruction Fuzzy Hash: ADA1D171B016169BEB24CF69C991BBAB7B1FF54324F204029EA45D7281EF78EC11EB50
              Function 00FF4500 Relevance: .3, Instructions: 275COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ea8d40e489fd97c9bd935e347e52a7664256c8c398b24ea4d79574e656816693
              • Instruction ID: 7cfa6419239856616eb84795d803cd7d325b820d1bdae6aa1d3a5411f698e768
              • Opcode Fuzzy Hash: ea8d40e489fd97c9bd935e347e52a7664256c8c398b24ea4d79574e656816693
              • Instruction Fuzzy Hash: 90A1CB72A04615AFC721EF18CD80B6AB7E9FF48764F050928F6859B261C738FD00EB91
              Function 00FF2B57 Relevance: .3, Instructions: 266COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
              • Instruction ID: b77f602f6713b26a394d3244f102bac21e4fe829346afd6d0a6760014370e67a
              • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
              • Instruction Fuzzy Hash: 78B12A71E0061ADFDF58CFA9C880AADB7B5FF88320F148169EA15A7364D734AD41DB90
              Function 00FA60E0 Relevance: .3, Instructions: 264COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9b993b224bfa87e0a4a92ab1cd4cb5d7dc4aa3ea3071496b82acc338aae623b4
              • Instruction ID: 2bc2d0e212566321ffd64824ed1a580e0dcf69240d337d774264ee91971ad6ac
              • Opcode Fuzzy Hash: 9b993b224bfa87e0a4a92ab1cd4cb5d7dc4aa3ea3071496b82acc338aae623b4
              • Instruction Fuzzy Hash: 3F91B1B1D00215AFDF15CFA8DC91BAEBBB5AF49710F194169E510EB341D738ED01ABA0
              Function 00F3E3F0 Relevance: .3, Instructions: 261COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e63399d85737c01c7513eb16015f82e3fca90b976edd3a709dfd984177e19e05
              • Instruction ID: 88df0f77a8c80cc1866eeac99a8aba20210fe00379af4cdf1bf267d0186f83d9
              • Opcode Fuzzy Hash: e63399d85737c01c7513eb16015f82e3fca90b976edd3a709dfd984177e19e05
              • Instruction Fuzzy Hash: DD911336E046159BDB24EB58C840BBEB7A2EF88734F194069EC45DB2C1E778DD01EB51
              Function 00F76ACC Relevance: .2, Instructions: 226COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0026f90948e904b57795e44a2c5de243a75d639853ff09f79f8054685bda86b8
              • Instruction ID: a1b816615e56c8dd2f7486170970e4a98566bfa6372ae22a4a7e2b601f762366
              • Opcode Fuzzy Hash: 0026f90948e904b57795e44a2c5de243a75d639853ff09f79f8054685bda86b8
              • Instruction Fuzzy Hash: D68194B1E006159FDB24CF69C940ABEB7F9FB48710F14852EE459E7640E734E940DB94
              Function 00FEAB40 Relevance: .2, Instructions: 222COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
              • Instruction ID: e55a6290edb1fb660ba2574d1bed758bd78b2b4b49e5de481051361aaf9ced2f
              • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
              • Instruction Fuzzy Hash: D6819331A002499FCF18DF9AC880AAEB7F2FF84310F148569E8169B345DB74ED01EB51
              Function 00F5E284 Relevance: .2, Instructions: 212COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cd361f2ee8c89ea69c00e1a1902a178d6055b7d524934d792518b19501e97ad0
              • Instruction ID: 8ffd08a58125c4840cbf5ab449da35676ce98a7c12ad5a9825bbe78eba72f095
              • Opcode Fuzzy Hash: cd361f2ee8c89ea69c00e1a1902a178d6055b7d524934d792518b19501e97ad0
              • Instruction Fuzzy Hash: 30816F71A00609EFDB25CFA9C880BEEBBBAFF48354F10442DE555A7250D770AD49EB60
              Function 00F3C640 Relevance: .2, Instructions: 206COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 479fd3d51c170de114127dbd17e67c9688796b56951084267c580d5e1c1b7e0b
              • Instruction ID: 46881b435a5f77897af4a468f2b7c16ebbefd061f7ed63e84bfde06d7489be4f
              • Opcode Fuzzy Hash: 479fd3d51c170de114127dbd17e67c9688796b56951084267c580d5e1c1b7e0b
              • Instruction Fuzzy Hash: 6571CE76D00625DBCB259F58C8907FEBBB5FF58760F24411AE842AB390D7799801EBD0
              Function 00FD47A0 Relevance: .2, Instructions: 202COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6ab246171c19d5105344a876576f31bee495baddd278b328e2057ee3831b7411
              • Instruction ID: e77c34380b5ac86ef50b460720a51174fc0923500876c6efc26c6858ea18bcc5
              • Opcode Fuzzy Hash: 6ab246171c19d5105344a876576f31bee495baddd278b328e2057ee3831b7411
              • Instruction Fuzzy Hash: 14719E70D00204EFCB20DF95DD41A9ABBFAEB82310B19415BE550AB359C7BEA940EB54
              Function 00F3260B Relevance: .2, Instructions: 201COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1adf3b6ed440ded0890237567a96e974a8f8df4459751894b6ea07d69e674e4e
              • Instruction ID: 8c365815e21032d04e840dd755d9ad1f6577a0c483055e94443107fd35e5412f
              • Opcode Fuzzy Hash: 1adf3b6ed440ded0890237567a96e974a8f8df4459751894b6ea07d69e674e4e
              • Instruction Fuzzy Hash: CE71E471A046418FC351DF28C881B6AB7E5FF84320F1485AAF899CB352DB38DC45EB91
              Function 00FB62A0 Relevance: .2, Instructions: 198COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d13f276e69e6cfea5f7b5f487ec6d760271a1c5b0a7e45645d17a40a08962aa3
              • Instruction ID: 58105c416d68aebe09e493bf1f30d3eac7cc40dd08a7eb02dda92c11d798aa69
              • Opcode Fuzzy Hash: d13f276e69e6cfea5f7b5f487ec6d760271a1c5b0a7e45645d17a40a08962aa3
              • Instruction Fuzzy Hash: 7D71DE32600A01EFDB21DF16CC45F9AB7E5EB44760F244828E256CB6A1D77DE944EF50
              Function 00FA035C Relevance: .2, Instructions: 198COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
              • Instruction ID: 7f5bc1ce651b9530cdf30588a922c08f1673daa0de0eb637b2dd225b0d8bfbfd
              • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
              • Instruction Fuzzy Hash: 3C719CB1E00609AFCB10DFA9D985EEEBBB9FF48310F144469E505E7251DB38EA01DB90
              Function 00F28AA0 Relevance: .2, Instructions: 197COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bef85f190eeee9263711cf06866e6890d6c6e83da97d389c7f26692b8429dce9
              • Instruction ID: 9c174a3d35a5020ff9b11791ca0653dcf7fa647b6d9f457bc64c2344d0ab68cc
              • Opcode Fuzzy Hash: bef85f190eeee9263711cf06866e6890d6c6e83da97d389c7f26692b8429dce9
              • Instruction Fuzzy Hash: 7F81A072A053158FDB24DF98E584BADB7B1BF88320F15412DD800AB395DB79AD41EB90
              Function 00FF8324 Relevance: .2, Instructions: 192COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f7f0845c27db7768e0fcfd3aa51ada8527c7425a3bc8d39c6e2de284a877ac44
              • Instruction ID: ea1fb5b2a3a2b0e77d2ac28a4b6704f905b4b2a08178a0866d4a1b7f25a85af7
              • Opcode Fuzzy Hash: f7f0845c27db7768e0fcfd3aa51ada8527c7425a3bc8d39c6e2de284a877ac44
              • Instruction Fuzzy Hash: 0C710A72E00619AFDF15DF94CC81FFEBBB9EF047A0F104119E611A62A0DB74AA45DB90
              Function 00FDA250 Relevance: .2, Instructions: 184COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e6d22f5303698ff47ee1165d284fb812b493544417474286918b66f53c0aa5da
              • Instruction ID: 64720dc26241a3f4d696a2078f28b6b9eaef257ba4ada9fb94be0a590da908a2
              • Opcode Fuzzy Hash: e6d22f5303698ff47ee1165d284fb812b493544417474286918b66f53c0aa5da
              • Instruction Fuzzy Hash: 1B51E172904711AFD312DE68C844F5BB7EAEBC6750F04092ABA40DB260D7B9ED04D7A7
              Function 00FC8350 Relevance: .2, Instructions: 161COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 297bcba8cc034cdc83b63f7745e1175e09db7f9ed7d635a431723b471ead67ab
              • Instruction ID: 72aacd08a648ba93922969e2a1e1389a37acb14e964a80d788ed024003893912
              • Opcode Fuzzy Hash: 297bcba8cc034cdc83b63f7745e1175e09db7f9ed7d635a431723b471ead67ab
              • Instruction Fuzzy Hash: E351CE709007069FC724DF56C982FABFBF8BF94760F10461EE192576A1CBB0A946EB50
              Function 00F5E443 Relevance: .2, Instructions: 158COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a70ea71642458b5413a2662fe981a42b22a94eef043963a3c0d44955a68551e2
              • Instruction ID: 8e6f62efab687b26953ce41f3ac4c783a0b86f29c354be5d97f624575ae3049c
              • Opcode Fuzzy Hash: a70ea71642458b5413a2662fe981a42b22a94eef043963a3c0d44955a68551e2
              • Instruction Fuzzy Hash: 1A515A72600A05DFDB25EFA4C980EAAB3F9FF047A4F510429EA41D7261D738EE45EB50
              Function 00FC4180 Relevance: .2, Instructions: 156COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 247aa9be351f844bc9c5fc540ed90fdcd540371a8f2d579d7b31d2c725744423
              • Instruction ID: 46b8b9ae1d813cbe88149d3e14b14d9f9234563cc88176c12b88d5652ea66ff4
              • Opcode Fuzzy Hash: 247aa9be351f844bc9c5fc540ed90fdcd540371a8f2d579d7b31d2c725744423
              • Instruction Fuzzy Hash: A75166B16083428FD750DF29C992A6BB7E5BFC8718F44492DF489C7250EB34E905EB92
              Function 00F445B1 Relevance: .2, Instructions: 156COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
              • Instruction ID: 2ed9af51f95071b788cb2ccb2a835719b30ee718868d170e08ac24b93f912b28
              • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
              • Instruction Fuzzy Hash: 0B519E71E0021AABDF15DF94C841BEEBBB5AF45754F044069ED01BB240E738EE45DBA0
              Function 00FAE9E0 Relevance: .2, Instructions: 154COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
              • Instruction ID: 025b014b0d17d408cc9f3cd01d767c810e9e9b5711d2199caa130c7561cbe34c
              • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
              • Instruction Fuzzy Hash: 2C51DAB1D00219EFDF10DF90CC99BAEB778AF423A4F154655E51267191D7389E40F7A0
              Function 00FE8B28 Relevance: .2, Instructions: 152COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dfe6e1089b273b281c7c7bf51bcf5b138e185d30c7cc1ec13de606cd54bbfd88
              • Instruction ID: 68dd1fe80d3a5f6beecc114b0b777a69e4ca36ae36743c9a9062d62e47b1341f
              • Opcode Fuzzy Hash: dfe6e1089b273b281c7c7bf51bcf5b138e185d30c7cc1ec13de606cd54bbfd88
              • Instruction Fuzzy Hash: AD41F571B016909BC624EB2BCD85B7BB79AAFC13B0F144519F81D87281DF34DC02E6A1
              Function 00FACBF0 Relevance: .1, Instructions: 148COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 256bb4e803d10828dfba968527b99e6bf6c0c3706500ee46f3ac5a6229e03397
              • Instruction ID: 29b0614ff299066e5f316f5b2e9745a7ca04668dc524f5ffb27bbd94e50a44c0
              • Opcode Fuzzy Hash: 256bb4e803d10828dfba968527b99e6bf6c0c3706500ee46f3ac5a6229e03397
              • Instruction Fuzzy Hash: A651BDB2D00215DFCB20DFA8C8809AEBBF9FF49764B114529E555A7304DB79AD01DBD0
              Function 00F5A430 Relevance: .1, Instructions: 139COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ca3f1629ba66b5e6f9472d6ad54fa098a9fb12804899f30dcbde6e7e4bf970fa
              • Instruction ID: aa0d338551817282d697c324417134e02ccd86ad619736e54005dc1952788349
              • Opcode Fuzzy Hash: ca3f1629ba66b5e6f9472d6ad54fa098a9fb12804899f30dcbde6e7e4bf970fa
              • Instruction Fuzzy Hash: 5541E632A402019BDB24EF659CA2FAA3764BB48719F05012DFE429B242D7BEAD14E751
              Function 00FEA9D3 Relevance: .1, Instructions: 139COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
              • Instruction ID: 2b75bd9093ac00266c1c01c75415a9c8de89f431be7ba090d7b5d8e87108ddba
              • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
              • Instruction Fuzzy Hash: A841E672A047569FC725CF25C980A6AB7A9FF80720B05463EF9128B241EB38FD18D791
              Function 00F501F8 Relevance: .1, Instructions: 138COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: aab626f893c5fc029255e277ba45a647d1755e62391880f3eaba2a4cd0384225
              • Instruction ID: 5bc2e1b6e2c6b597d140a6a15091a33e9b2b9293044206f430bc378a05a82526
              • Opcode Fuzzy Hash: aab626f893c5fc029255e277ba45a647d1755e62391880f3eaba2a4cd0384225
              • Instruction Fuzzy Hash: CD419C36D00219DBCB14DF98C840AEDB7B4BF48721F24816AEE15E7350EB359D49EBA4
              Function 00F4EBFC Relevance: .1, Instructions: 138COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1e44805c611d8331065e9676b67ef450aabec7d925eceb6ade94c3b79619d8e1
              • Instruction ID: 264eccd49c3b911297ed9d05ab7de6f3ccf8af1c90638adb22a24a44fb688210
              • Opcode Fuzzy Hash: 1e44805c611d8331065e9676b67ef450aabec7d925eceb6ade94c3b79619d8e1
              • Instruction Fuzzy Hash: 1841B5726043019FD724EF24C881A5BBBE5FF88324F144839EA56C7711DB39E848EB51
              Function 00F62750 Relevance: .1, Instructions: 137COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
              • Instruction ID: c9f7dcc4718d27af42b378d9abe1d03aea43ce96fd91ed26d2eb01bcbde04ed0
              • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
              • Instruction Fuzzy Hash: D3514975E00619CFDB14CF99C480AAEF7B2FF84720F2881A9D815AB350D770AE42DB90
              Function 00F26154 Relevance: .1, Instructions: 133COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fd3fa3a946471fde81449324309cf0239c2cb600663f0a38f4884214b8e46c27
              • Instruction ID: 9cb8ba66fb4a686affd53109772d08682aef68a17f8266b470071138926943f0
              • Opcode Fuzzy Hash: fd3fa3a946471fde81449324309cf0239c2cb600663f0a38f4884214b8e46c27
              • Instruction Fuzzy Hash: 49510471900126DBDB65DB64DC01BE8B7B1EF11324F1482A5E429E72D2DB79AD81EF80
              Function 00F20BCD Relevance: .1, Instructions: 130COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e393216b241529e98ecf72af5137d9652060fe762ab5bc0538debe5f748f9325
              • Instruction ID: 3a9f2183f74ce691515afa539c6c5bc209e06ab24f777160f621cdf3801605ff
              • Opcode Fuzzy Hash: e393216b241529e98ecf72af5137d9652060fe762ab5bc0538debe5f748f9325
              • Instruction Fuzzy Hash: 6141A572E402289BCB31DF64DD41BEE77B4EF49750F0141A6E908AB242DB78DE80DB51
              Function 00FE866E Relevance: .1, Instructions: 129COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
              • Instruction ID: 5b762e69358877deb1018cddeafa6deb336ca1a24efbf5076def38b648b9ca1b
              • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
              • Instruction Fuzzy Hash: F641D875F00245ABDB14EF96CC81AAFB7BAAF84390F244069E809E7341DE74DD02D750
              Function 00F20887 Relevance: .1, Instructions: 128COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 82d1ae5d1df6b076f102f8358dee8e0e5a7966a22e96c8470661a952883e353d
              • Instruction ID: 9810e0dd9a81f2a7412f5c1bb9b1b4be0168f67189f2c10bc39a6913a39e4634
              • Opcode Fuzzy Hash: 82d1ae5d1df6b076f102f8358dee8e0e5a7966a22e96c8470661a952883e353d
              • Instruction Fuzzy Hash: BB41B3726007119FD725CF24D880A26B7F5FF49314B108A6EE54787B52EB35F885EB90
              Function 00F4A470 Relevance: .1, Instructions: 127COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a0b8bea03a549cfc7899db425798f042016a81d7a45f9d833e4c7a087c9542ad
              • Instruction ID: d4cd35e20831f118fe2bb771d8dc8897cd9798d4249904be335e8ec086bd7b69
              • Opcode Fuzzy Hash: a0b8bea03a549cfc7899db425798f042016a81d7a45f9d833e4c7a087c9542ad
              • Instruction Fuzzy Hash: 7341C532A80604CFCB20DF68D9557EE7BB0FF04360F1801AAD811AB3A5DB799D40EB51
              Function 00F28BF0 Relevance: .1, Instructions: 124COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2662ae52426d76417247dc31ad637d4cb068a0824c702821620be2e628a0ec1f
              • Instruction ID: 61add0bf157815e99c69421fb303fd579ed0db28545eb68d1416ac0090e3339c
              • Opcode Fuzzy Hash: 2662ae52426d76417247dc31ad637d4cb068a0824c702821620be2e628a0ec1f
              • Instruction Fuzzy Hash: D2410772901211CBC724DF58E841B9AB7B1FB84754F24812EE4019B356CB3DDD42EBA0
              Function 00F18918 Relevance: .1, Instructions: 123COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9f243e0009d2907ce6ff9e8af249bb57b7242a6c781e4463ba987986d557af2e
              • Instruction ID: 62f600dc601c6cda0049e5cf3cfae9792a81d57391239f3216d9b15a01fcb9e3
              • Opcode Fuzzy Hash: 9f243e0009d2907ce6ff9e8af249bb57b7242a6c781e4463ba987986d557af2e
              • Instruction Fuzzy Hash: 42419F325087069ED311DF64C941BABB7E8EF84B94F40092BF984D7250EB34DE45AB93
              Function 00F1A020 Relevance: .1, Instructions: 122COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
              • Instruction ID: aa7fb0e90cc01cc2ea56adca06ebb448de72d946ad533028c373d2c88aa76f6f
              • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
              • Instruction Fuzzy Hash: E7412632E01211EBCB20DEA588407FAB761EF95B24F25C06BE8499B244D7358DC0FB93
              Function 00F209AD Relevance: .1, Instructions: 122COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: da4fbbc9e7a1e033c530a7f83ed12fd855d2a047c0dd6297a4ae4467fc996971
              • Instruction ID: 00e57ef950728e8959e7b4d1adc5fa179cff32c2477e88cf88e989c338405a3e
              • Opcode Fuzzy Hash: da4fbbc9e7a1e033c530a7f83ed12fd855d2a047c0dd6297a4ae4467fc996971
              • Instruction Fuzzy Hash: 0A417872A01710AFD321CF18D840B2AB7F4EF48724F64856AE4498B252EB79ED42DB91
              Function 00F50710 Relevance: .1, Instructions: 121COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
              • Instruction ID: 496e7348f430f9b562630c62e2fdf80a49991a93ad70435013a8b27dc93ca089
              • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
              • Instruction Fuzzy Hash: 5F411B71A00605EFCB24CF98D980AAAB7F4FF18711B20496DEA56D7691D730EA48EF50
              Function 00F2262C Relevance: .1, Instructions: 119COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0d380628c5ca25936a9c4dc4be19e4e5e3f3b0e2978e0c23ced50ba6ee8d8210
              • Instruction ID: 23f350fc44660564a8c852e96a66a20c89b8cd017cd92e5fce6df109bb6f767b
              • Opcode Fuzzy Hash: 0d380628c5ca25936a9c4dc4be19e4e5e3f3b0e2978e0c23ced50ba6ee8d8210
              • Instruction Fuzzy Hash: 8541E472905710EFCB61EF24ED01B59B7B1FF44320F10826AD8469B2A1DB789941EF41
              Function 00F5C8F9 Relevance: .1, Instructions: 116COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d5714ccee1d8a23bf8d72f24ff3a5b518e4c7548612485c91709f4eaabc7f29e
              • Instruction ID: 9f68a7a2ebb5edc3a21c97757ccdc5916d14a246465b38bdab8fb3d8ccbd3dde
              • Opcode Fuzzy Hash: d5714ccee1d8a23bf8d72f24ff3a5b518e4c7548612485c91709f4eaabc7f29e
              • Instruction Fuzzy Hash: 14319AB1A00349DFDB11CF68C440799BBF0FF09725F2081AAE509DB251D7369906EF90
              Function 00FA07C3 Relevance: .1, Instructions: 114COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 62092620529168d34f05ccf29d45c16c3bf73f1f1969bb65be63ca66ca1ce777
              • Instruction ID: e34b5c69fe079bb3fc21cdbfc524cf14a5a693577f140ae79ca0a34c4de3eecb
              • Opcode Fuzzy Hash: 62092620529168d34f05ccf29d45c16c3bf73f1f1969bb65be63ca66ca1ce777
              • Instruction Fuzzy Hash: 114183B19043019BD360DF24C845B9BBBE8FF88754F004A2AF598D7291DB789904DB92
              Function 00F180A0 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7222bfa1a3d19f31726c68af1d6524e88bdd3c2fa3fa859f147ca0f25643f884
              • Instruction ID: d71f1978f124bb6747c745143dac68acbe0a082eb1b5be017f47cecbd51ad8cc
              • Opcode Fuzzy Hash: 7222bfa1a3d19f31726c68af1d6524e88bdd3c2fa3fa859f147ca0f25643f884
              • Instruction Fuzzy Hash: 5741C373E05615AFCB00DF54CE416E8B7B1BF547A0F248229E815B7280DB34ED83AB90
              Function 00FA05A7 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0e3cfc3eb6f6ab982b110aad02e9bcd71f0493218b8d747a606b9469cff405cb
              • Instruction ID: 257856f88963a04071d37c0d5e236d5cdd9e9941b65ba07d17b973367ca644ad
              • Opcode Fuzzy Hash: 0e3cfc3eb6f6ab982b110aad02e9bcd71f0493218b8d747a606b9469cff405cb
              • Instruction Fuzzy Hash: C041C2B2A086419FC320DF68E840A6AB3E9EFC9710F044629F89597680EB34ED14D7A5
              Function 00F24859 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 459d969ae3c0603fd38ac1f53d38da7209ecb145ff7be29810caadd9e2523580
              • Instruction ID: 20bff79d64098f4a11a73f7ac94368c3f685da770c2efbd6123dec977d9e5894
              • Opcode Fuzzy Hash: 459d969ae3c0603fd38ac1f53d38da7209ecb145ff7be29810caadd9e2523580
              • Instruction Fuzzy Hash: A641E431A003118BC725DF28E894B2BB7E9EF80760F14442DF9958B291DBB5ED81EB51
              Function 00F18B50 Relevance: .1, Instructions: 111COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 50f4fc2d75069b6e10d3d3ef6326aca29e4bbeee8d3bbca6ca990f542cfce082
              • Instruction ID: 395d067c4145a48a8e8a4ce4007ded011aba6b3563d235cbe153cdc9277d5cc0
              • Opcode Fuzzy Hash: 50f4fc2d75069b6e10d3d3ef6326aca29e4bbeee8d3bbca6ca990f542cfce082
              • Instruction Fuzzy Hash: B741A472E01614CFCB14DF69CA806DDB7F1FF89360F20852AE456A7251DB349D82EB50
              Function 00F302E1 Relevance: .1, Instructions: 106COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
              • Instruction ID: 3126b88ace38bfe5c8a5e48fe13ce611dae736eeaeee416e7a252f38d2d00a8d
              • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
              • Instruction Fuzzy Hash: 75312832A05244AFDB119B68CC80BDEBBE9EF04760F1441B6F855D7352C678D984EBA4
              Function 00FCE3DB Relevance: .1, Instructions: 105COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9b37ddc773ab1a7fac4ae04cca324c34f096129feceec87aa6a9218da4dfccf3
              • Instruction ID: a0c78f280ff6c782885c76a555c7cb4ad0bb353120b462fceb094b8fa40c984c
              • Opcode Fuzzy Hash: 9b37ddc773ab1a7fac4ae04cca324c34f096129feceec87aa6a9218da4dfccf3
              • Instruction Fuzzy Hash: 9731CB75740716ABD726EF558D42FAF76B8AF48B50F110028FA00AB3D1DAA8DD01E7E0
              Function 00FD4B4B Relevance: .1, Instructions: 104COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1fab413c1b4887c2926a29fed7e6f98336efe909eb6157f4f7e92aec43ed6610
              • Instruction ID: 0ddc8b8eb8160e79b5c3f8601effbfb6639bd98b456dbb496d5c3f7c103ee7db
              • Opcode Fuzzy Hash: 1fab413c1b4887c2926a29fed7e6f98336efe909eb6157f4f7e92aec43ed6610
              • Instruction Fuzzy Hash: 2D318D32A162008FC720DF19D881E6AB7E6FB85360F0A446EE8959B351D776EC40EB91
              Function 00F24260 Relevance: .1, Instructions: 102COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d166fdcfd5ba8308cf9ea7f19414d57975fc618c9ece8435c389c78aee0bf612
              • Instruction ID: d8104faed30acb36563a0cb704b4b62c888f09e08d21f5a1a0618b018fe5d28f
              • Opcode Fuzzy Hash: d166fdcfd5ba8308cf9ea7f19414d57975fc618c9ece8435c389c78aee0bf612
              • Instruction Fuzzy Hash: 4141DF31600B04DFC762DF24C885FE677E9BF49320F104829E5998B291CBB8EC44EB90
              Function 00FD4BB0 Relevance: .1, Instructions: 101COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 841d61be06d525447d3ed23a960232b3c0f4112df1d2498ed99778040e1e08cd
              • Instruction ID: f7870aa6887784e78fc7b654881bcaa3a6648e22bd5d8e4f840c14143241d446
              • Opcode Fuzzy Hash: 841d61be06d525447d3ed23a960232b3c0f4112df1d2498ed99778040e1e08cd
              • Instruction Fuzzy Hash: 503170727152019FC720DF28C881A2AB3E6FB84720F19456EF8959B351E735ED04EB51
              Function 00F9EB1D Relevance: .1, Instructions: 100COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e0bb0f3df6b8c31165ce953b6510af9da1229dcd4a2ec83f7fcc7bf8a4ad2298
              • Instruction ID: b62ea378d2e94529e5a9d9d7d159b24b239a8c6afacab82bad32a2f47f6f3e39
              • Opcode Fuzzy Hash: e0bb0f3df6b8c31165ce953b6510af9da1229dcd4a2ec83f7fcc7bf8a4ad2298
              • Instruction Fuzzy Hash: 1131D372B01685DBFB22DB59CD48B6577D8BF81B64F1D04B0AA859B6D2DB2CDC40E220
              Function 00FE61C3 Relevance: .1, Instructions: 97COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a41cb5807ba6e354a7ad781eb97b0aa12389e8d8ec6f8a3642747d936ad92e90
              • Instruction ID: 890c77e1d4d0ba2b2252aa1eb21d9b6e447a014831ebca0fd1557e2c69a3e99e
              • Opcode Fuzzy Hash: a41cb5807ba6e354a7ad781eb97b0aa12389e8d8ec6f8a3642747d936ad92e90
              • Instruction Fuzzy Hash: 5731D076E00259ABDB15DF99CC41BAEB3B5EB48B90F414168E900EB284D774ED00DBA4
              Function 00FC483A Relevance: .1, Instructions: 96COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 26ccf2471401ec767e6e7f7868d3ec1c27e8a45b0ee5da2dfa01d1b114576934
              • Instruction ID: fdb9a627e108479cbd2a237945aa6eb4ce12eb795277e2b07d2a09e4a9dfc48d
              • Opcode Fuzzy Hash: 26ccf2471401ec767e6e7f7868d3ec1c27e8a45b0ee5da2dfa01d1b114576934
              • Instruction Fuzzy Hash: 4C317076A4113DABCB21DF54DD85FDEB7BAAB98350F1000A5B508A7250CA34EE919F90
              Function 00F4EB20 Relevance: .1, Instructions: 96COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 243533b91d8224e35ae613d3cbbe1039faa2654a329d7133ba77a1f45ae2bb4e
              • Instruction ID: 0221a3e64d0f19a50a195af21783110121485d7865d9ec321832b726baa034eb
              • Opcode Fuzzy Hash: 243533b91d8224e35ae613d3cbbe1039faa2654a329d7133ba77a1f45ae2bb4e
              • Instruction Fuzzy Hash: 9531C472E00214AFDB21DFA9CC40BAEBBF9FF88760F114425F916E7251D6749E00AB90
              Function 00FE60B8 Relevance: .1, Instructions: 95COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 248c074f83a1b07176986520728bd8bcf73b9ada8594678ed472d3595b8da962
              • Instruction ID: 956ba2e28e9b3b6297054a0434b92efc780b7d06ee6d2b5d6537a94afd5b9699
              • Opcode Fuzzy Hash: 248c074f83a1b07176986520728bd8bcf73b9ada8594678ed472d3595b8da962
              • Instruction Fuzzy Hash: E6313832A00219EFC7129F9ACC40B6EB7B5AF547A0F00006DF501DB352DA38ED00A790
              Function 00F207AF Relevance: .1, Instructions: 95COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a30bb1d6c40f3b3ff222fa639329c90f684dc71fd847acfad966560bb337fd32
              • Instruction ID: 11ac2014205b21f197e5f7ecfa451f0ca33bba71e055588fee260e3162b085d4
              • Opcode Fuzzy Hash: a30bb1d6c40f3b3ff222fa639329c90f684dc71fd847acfad966560bb337fd32
              • Instruction Fuzzy Hash: B931D673A04621DBC712DE249840EAB7BA5EF94760F114529FC559B312DE34DC01B7D2
              Function 00F28550 Relevance: .1, Instructions: 94COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2bcb99ea060353e496d038f21c4b5c42d7e6a4032069c27a65644599edb69bbc
              • Instruction ID: f792def8e8e6b992799d323ec09abf099c78235de05bcf66faa74b85e0cd963c
              • Opcode Fuzzy Hash: 2bcb99ea060353e496d038f21c4b5c42d7e6a4032069c27a65644599edb69bbc
              • Instruction Fuzzy Hash: 4E318972A093118FD760DF19C841B6AB7E4EF88760F18496DE8889B391D774EC44EB91
              Function 00F5A6C7 Relevance: .1, Instructions: 92COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
              • Instruction ID: 9279d1725b4737a8302bf79344bc78e28e8461ae13bba524b21a53f11db8fcb4
              • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
              • Instruction Fuzzy Hash: BD314D72B00B01AFD761CF69DD41B57B7F8BF08B60F140A2DA99AC3650E630E904EB61
              Function 00FCEBD0 Relevance: .1, Instructions: 91COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6e20b80a858096b58b1a3c93356d6281ea112867cea72ab15a36d8f632184db9
              • Instruction ID: 3e6ab1f393a2f122b242c770027609078d92014130457e4ff687cf67816e3056
              • Opcode Fuzzy Hash: 6e20b80a858096b58b1a3c93356d6281ea112867cea72ab15a36d8f632184db9
              • Instruction Fuzzy Hash: 5A319A719493428FC720DF19CA42A5ABBF1FF89328F4449AEF4889B251D335DE44DB92
              Function 00F4438F Relevance: .1, Instructions: 89COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b8de79e17ebb63faa6dde8870888f73f07472182eb3e9ff706b122117649334
              • Instruction ID: a3eba3ba79229b28a8de6eb6d692d79b677fe1c860a569a5aa18611bf09128e1
              • Opcode Fuzzy Hash: 0b8de79e17ebb63faa6dde8870888f73f07472182eb3e9ff706b122117649334
              • Instruction Fuzzy Hash: 1D31D632B002059FD720EFA4CD81B6E7BF9AB84704F104529EC55E72A5E738ED45EB90
              Function 00F1CB7E Relevance: .1, Instructions: 89COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
              • Instruction ID: 8ab540a7177cd70343a253a6e95307a081761ba61539b7ec98b3614fcc425ebb
              • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
              • Instruction Fuzzy Hash: 33212636E4125AAACB10DFB58801BEFB7B5AF84750F168036AD59F7340E235DD40A7E2
              Function 00F1C156 Relevance: .1, Instructions: 88COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 151386e9d9b0c7984467fd14516612edb10501d3a2ef64b55d4746de55776e12
              • Instruction ID: d1255577908be84fc67c0cea9c3a9fd3b8dea107391af422849efae242364cba
              • Opcode Fuzzy Hash: 151386e9d9b0c7984467fd14516612edb10501d3a2ef64b55d4746de55776e12
              • Instruction Fuzzy Hash: 91313E729002108BC724AF14CC41B7977B4AF44324F94C56AEC899B342DE7DED82EB91
              Function 00FDC3CD Relevance: .1, Instructions: 88COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
              • Instruction ID: 42ca72a07ae5f09c685b7cdd84dc05a46575c96176c113f13c729328815ab7de
              • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
              • Instruction Fuzzy Hash: D0212B36600652A6CB15EB958C11ABAB7B7EF40710F44801BF99587791E63CDD40E3E0
              Function 00F1E420 Relevance: .1, Instructions: 88COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c55e67e98af685fa63e3fee806f60c86d6d3db6b198840e5d6b195f7b52bd0f5
              • Instruction ID: 7a8b9666dcdf10531d688b2da1c899eaacf5315c632192faada2285cf301cab7
              • Opcode Fuzzy Hash: c55e67e98af685fa63e3fee806f60c86d6d3db6b198840e5d6b195f7b52bd0f5
              • Instruction Fuzzy Hash: 3331F936A4152C9BDB31DF14CC42FEEB7B9EB15750F0500A1F945A7290D678AEC0AF90
              Function 00F544B0 Relevance: .1, Instructions: 87COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 73fe1012f418926f62440d5a16254b0bacd9bacd58f2f810a6207c1e2f0e122d
              • Instruction ID: 47004d53241665bb63657e03d30edc6f5eb6945e454145b3b59d56ebedfc6976
              • Opcode Fuzzy Hash: 73fe1012f418926f62440d5a16254b0bacd9bacd58f2f810a6207c1e2f0e122d
              • Instruction Fuzzy Hash: 1A21E172A047059BCB22DF18C880B6BB7E4FB88765F044529FE549B241E734ED44ABA2
              Function 00F54588 Relevance: .1, Instructions: 87COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
              • Instruction ID: 80966274142d8d6061ae016557f235a21b9e41372619c9f08b93fef7ea6e1e79
              • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
              • Instruction Fuzzy Hash: 03219136A00608EFCB11CF58C980B8EBBF5FF49719F508065EE259B241D674EE899B90
              Function 00F1E388 Relevance: .1, Instructions: 86COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
              • Instruction ID: ec76353b0e7100cc4c76d7f47eccfe59cb0e77faf5b88dc275ce6cfb36566ce3
              • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
              • Instruction Fuzzy Hash: 33319F31600604EFD721CF68C884FAAB7F9EF85354F1445A9E956CB291E734EE41EB50
              Function 00F9E609 Relevance: .1, Instructions: 86COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7cf7a14ec62b7a5e6716ac3760d0326f6fed36d0e3819e77f131a6612d881192
              • Instruction ID: 855c94dd184f629c44ba17d93c69c63a83d99bb96581f8ff76a375ebfe18681d
              • Opcode Fuzzy Hash: 7cf7a14ec62b7a5e6716ac3760d0326f6fed36d0e3819e77f131a6612d881192
              • Instruction Fuzzy Hash: 8631DC76A10205DFDF18CF08C8849AEB7B5FF94300B118469F8499B391EB71EE50DB90
              Function 00FA06F1 Relevance: .1, Instructions: 79COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4db93b62175ae02205ef21f780e239915cb19f3ffb65f756565e675f26bc97ae
              • Instruction ID: 8cf7014a1ed0115e5b9fb9f1572954efe8ba8c949f6be9115f383f61812a6aac
              • Opcode Fuzzy Hash: 4db93b62175ae02205ef21f780e239915cb19f3ffb65f756565e675f26bc97ae
              • Instruction Fuzzy Hash: 28219F75A00629DBCF25DF59D881ABEB7F4FF49750F500069F841AB240DB38AD42EBA1
              Function 00FA019F Relevance: .1, Instructions: 78COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: aa32565e6d656e5a645b9af3e8da02063afba53b628072dd4cf995b367cabba7
              • Instruction ID: 6bc369630325c763505e766f8076732b2f8b7d857d3c2d84042800ebe04a137d
              • Opcode Fuzzy Hash: aa32565e6d656e5a645b9af3e8da02063afba53b628072dd4cf995b367cabba7
              • Instruction Fuzzy Hash: 7E21BCB1A00604AFC715DB68DC44F6AB7F8FF89750F140069F804DB691DA38EE40DBA4
              Function 00FA0283 Relevance: .1, Instructions: 74COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fbe6b103f424debe473d360af0d7c34a0afeb0e24ea83555818316d78d649cd8
              • Instruction ID: 5cb1070144452191716d4a03adb9a0f59c1a16b6bf9f2336490dde1c6a691f11
              • Opcode Fuzzy Hash: fbe6b103f424debe473d360af0d7c34a0afeb0e24ea83555818316d78d649cd8
              • Instruction Fuzzy Hash: 3321C5B29043459FC711DF59E848B6BBBDCAF92360F084466BD80D7251DB38EA44E6A1
              Function 00F42835 Relevance: .1, Instructions: 73COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 79ecd7b079023dad69db1e02b53854d5dec28678d85516d8f53b63531c210f41
              • Instruction ID: 0236c6e410bfd6a5906f664ee2661fec54a3d5869cda164e0aa9785b84f164b9
              • Opcode Fuzzy Hash: 79ecd7b079023dad69db1e02b53854d5dec28678d85516d8f53b63531c210f41
              • Instruction Fuzzy Hash: 9E21D733A456849BF322A7689D44B687BD4EF41774F280372F920DBAD2DB6CCC41E241
              Function 00F5A30B Relevance: .1, Instructions: 70COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 17cea83985f1424da710415226811090c2926a936123d301b7b4642692cfeb42
              • Instruction ID: 95192e58287260900f213f4769a3e7b66ebb6314b0de95052548e3551a0d5f22
              • Opcode Fuzzy Hash: 17cea83985f1424da710415226811090c2926a936123d301b7b4642692cfeb42
              • Instruction Fuzzy Hash: C421AC75600A009FCB25DF29CC01B4673F5AF48B58F248568A949CB762E73AE942DB94
              Function 00FDA49A Relevance: .1, Instructions: 70COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 36dccb02c5895bebc7e028210c4e671f65e6fb6254218c1321bcf61b2f4d791c
              • Instruction ID: e585f15760b9d0093acec7ab9f050a9ca681d390453dffeeaad3f3c4c83c751d
              • Opcode Fuzzy Hash: 36dccb02c5895bebc7e028210c4e671f65e6fb6254218c1321bcf61b2f4d791c
              • Instruction Fuzzy Hash: BF113A73350E107FD3226654AC01F2B769ADBC5B30F1C0025B608DB3D1EAA4DC00A69B
              Function 00FA0946 Relevance: .1, Instructions: 70COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b9b1e3ce5aa0e06a6ff8aeb67c07bc13f96153a188a392a4bf9c00f270de4848
              • Instruction ID: da34f4a820227108662110ead23dc25de1848dc5a02f1503540934e17a191337
              • Opcode Fuzzy Hash: b9b1e3ce5aa0e06a6ff8aeb67c07bc13f96153a188a392a4bf9c00f270de4848
              • Instruction Fuzzy Hash: A321EBB1E00218ABCB14DF9AD8819AEFBF8FF99710F10012EE405A7355DB749941DB64
              Function 00FB80A8 Relevance: .1, Instructions: 69COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
              • Instruction ID: 4b642bacfd6ae7c0450fbc4c379113f0a66d71fa0f2d30ac4d9c0b2d6d5bd8ab
              • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
              • Instruction Fuzzy Hash: 80216F72A00209AFDB119F59CC40BDEBBB9EF843A0F200455F901A7251D734DD52EF50
              Function 00F50124 Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
              • Instruction ID: ee430e3ccd52afcf13e4fe22be0797dfa9b7732e69cd5653462a8f989d719253
              • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
              • Instruction Fuzzy Hash: DE11C473601A04BFD7229F54CC41F9ABBB8EB80765F204029FF059B190DA75ED48EB51
              Function 00F28770 Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 500c13d4d7d0c6e9046a03f4263cbb300c15b5c42a48b992ce5a9143958e66be
              • Instruction ID: 24bcbe11d64c37ee56283c16c495bad268647dc8e05b3daf32966f021763890c
              • Opcode Fuzzy Hash: 500c13d4d7d0c6e9046a03f4263cbb300c15b5c42a48b992ce5a9143958e66be
              • Instruction Fuzzy Hash: 3F11AB35B02631DBCB11CF49D5C0A66B7E5EF5A7A0B24406DED08DF205DAB6DD02D790
              Function 00F5AAEE Relevance: .1, Instructions: 68COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
              • Instruction ID: e0ba399eafa26e0f87a3769425778677a1686bffd410c79630c7ca8ba633e814
              • Opcode Fuzzy Hash: 3b9caaf395a22a4929ed725bdef4f5484843110ef385696de3fd96b14fff4041
              • Instruction Fuzzy Hash: 1B21D172A00A00EFC735CF49C540A66F7E6EBD4B21F20823DEA4587A21D734ED04EB80
              Function 00F280E9 Relevance: .1, Instructions: 66COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: aee40b7f2fe8da5267e0f04675eae2f4ea7ba71d97f85733bca1c724eefdf002
              • Instruction ID: 75c67faa06da72c402eb5bb8521168058209e9ffaafb1e21ce7c6ce93f670f6b
              • Opcode Fuzzy Hash: aee40b7f2fe8da5267e0f04675eae2f4ea7ba71d97f85733bca1c724eefdf002
              • Instruction Fuzzy Hash: 32218B32A01205DFCB14CF98C581BAEBBB5FB88368F20416DD105AB390CB71AE17DB90
              Function 00F5674D Relevance: .1, Instructions: 65COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 008003b5e5a8a4503316246b490ce84d439ba51d532915937f982e9b110a39f3
              • Instruction ID: c3ef975a7392c12641767296547bb659bb388f4002bcc0a7105d9c61251db0b7
              • Opcode Fuzzy Hash: 008003b5e5a8a4503316246b490ce84d439ba51d532915937f982e9b110a39f3
              • Instruction Fuzzy Hash: A4218E71500A00EFC7208F68D841F66B7F8FF48765F54882DE9AAC7650DA74AD44EB60
              Function 00F4E8C0 Relevance: .1, Instructions: 63COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 12aaa1fa63b323e7bccdf80a0732a6e7ef6574d52879bee80c9c0aaab6d09b0c
              • Instruction ID: ae97be4b3005741865753a5b1a6c368b971aeaf844307964ab9379ce7f485eb0
              • Opcode Fuzzy Hash: 12aaa1fa63b323e7bccdf80a0732a6e7ef6574d52879bee80c9c0aaab6d09b0c
              • Instruction Fuzzy Hash: C2116633700114AFCB19DB25CC81AAB7656FFD1374B344539E922CB280E931DD02E390
              Function 00FB6870 Relevance: .1, Instructions: 63COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5a3d567e5aea0ec5a4e68b5c419fbc2e9ad478337fc6130706a07a00fd8703b0
              • Instruction ID: dff8fd071302a0ba9baf979606b26f34e716350ad4124f11aaadd39258c2b626
              • Opcode Fuzzy Hash: 5a3d567e5aea0ec5a4e68b5c419fbc2e9ad478337fc6130706a07a00fd8703b0
              • Instruction Fuzzy Hash: C311E333240614EFD722DF5ACD40F9A77A8EF99B60F114025F205DB251DA78ED01EB90
              Function 00F566B0 Relevance: .1, Instructions: 61COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 13a74e633f51ea642510488aa3d245797e5644944152510e2743f1ca6adf1e84
              • Instruction ID: a4657e1f20447a54b53f1237d7484181e443795babb60dbd83f61ca350ed5240
              • Opcode Fuzzy Hash: 13a74e633f51ea642510488aa3d245797e5644944152510e2743f1ca6adf1e84
              • Instruction Fuzzy Hash: 31110E76E01204DFCB25CF59E880A0ABBE8AF88324F414079EE15DB310EA38DD04EB90
              Function 00FEA8E4 Relevance: .1, Instructions: 61COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
              • Instruction ID: a8718983ef0729bc9d697605849004945ab80fbd3e6f88c71eea46a538db145a
              • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
              • Instruction Fuzzy Hash: 5C110432A00909AFCB19CB55CC01B9DB7B5EF84310F058269F84597341E675BE01DB90
              Function 00F20AD0 Relevance: .1, Instructions: 61COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
              • Instruction ID: 6bbd416248d6208bcb7f9208729be648616d72ae4fc95234c011b49244e932c9
              • Opcode Fuzzy Hash: 975f93ae0bdd36ad56dc7d48bb40b3373a7fecd11d003270eb178f636a7ee754
              • Instruction Fuzzy Hash: E821F4B5A00B059FD3A0CF29D541B56BBF4FB48B20F10492AE88AC7B41E771E854CB90
              Function 00FAE7E1 Relevance: .1, Instructions: 59COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
              • Instruction ID: 3d1af98303d4d188032307cc18b06f01cb64fbf09fe14053158a2e51a70c2232
              • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
              • Instruction Fuzzy Hash: 8411CEB2A00600EFDB209F44CC41B5AB7E9EF46760F158428F809AB261DB79DD40FBA0
              Function 00F427ED Relevance: .1, Instructions: 58COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dbff2065202b62b80c6c05b448f061f2d6c16333d4f765b492bfbe222222d444
              • Instruction ID: a22fba8366a0261b4ce7e20a12a2f2e730d5b59a57c4e3460110fb2d5865a6f4
              • Opcode Fuzzy Hash: dbff2065202b62b80c6c05b448f061f2d6c16333d4f765b492bfbe222222d444
              • Instruction Fuzzy Hash: B201C472A05644AFE316A269DC85F6B7A9CEF817A4F550076F901CB651DA1CDC00E2B2
              Function 00F24690 Relevance: .1, Instructions: 57COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ceeb3c4d91f9bd6ad954a766b404727998aeab4aab8083b7c23d3de000dc4d7a
              • Instruction ID: d559eaf790180c313ae38218831334d74243e5f5443151b24615645f0b8b899a
              • Opcode Fuzzy Hash: ceeb3c4d91f9bd6ad954a766b404727998aeab4aab8083b7c23d3de000dc4d7a
              • Instruction Fuzzy Hash: 3511CE36600768AFCB25CF59E840F567BA8EB86B74F104519F9288B290C7B4FC40EF60
              Function 00F56620 Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: ad1742af9c05fe3c729e56bbe8a5e2ca5bb98207689eaa233aee8532cefc3c69
              • Instruction ID: 0af945b19eaddf266f31d9d1469db6436c70079e671dc5bd152b73798783330d
              • Opcode Fuzzy Hash: ad1742af9c05fe3c729e56bbe8a5e2ca5bb98207689eaa233aee8532cefc3c69
              • Instruction Fuzzy Hash: C711C272D00614ABCB21DF98DD81B5EF7B8EF88B51F900058EE10AB201D738AD45AB50
              Function 00F4EA2E Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9e7f687a6a3867745bf828da5e9c05c32ff481b4f50abd7f7b89142136d53832
              • Instruction ID: f2cf72787f7cbf3ad6f152469ab45575c22fd1c0afe9b8b9c0423886a30fe280
              • Opcode Fuzzy Hash: 9e7f687a6a3867745bf828da5e9c05c32ff481b4f50abd7f7b89142136d53832
              • Instruction Fuzzy Hash: 3D019E715001089FC725DF15E845F66BBF9FBC6324F24826AF4458B265D77CAC42DB90
              Function 00F4E53E Relevance: .1, Instructions: 55COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
              • Instruction ID: e5f89e647206bf951733c966fb37ff3cd4bc0ce12bec6a06aabcf105ce49ecdd
              • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
              • Instruction Fuzzy Hash: AD11CE72A016C59FE722A728D944BA53BA4FB40778F2D00B0ED45CB682E32CCC46F360
              Function 00FAE75D Relevance: .1, Instructions: 54COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
              • Instruction ID: 8b22772e2694ef0a632b66eb3099505a6acb185c795ea60b73c2a720169aa30c
              • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
              • Instruction Fuzzy Hash: B60124B2A00204AFD7219F54CC41F5BBBA9EF86B60F158134F9159B260E775DD40FB90
              Function 00F1A250 Relevance: .1, Instructions: 52COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
              • Instruction ID: e2a797e185350400dd3f9096ab48f7fb43461e81f1aff70cfc5e52f9c88f4353
              • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
              • Instruction Fuzzy Hash: 2D012272806B519BCB308F15D840AB67BA4EF55B70B008A2DFC958B280C735D840EBA1
              Function 00FF4940 Relevance: .1, Instructions: 52COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 3a62b0a972beee03b812ba7cda6906f401efaaa3c807110fa229ae2f4f41a73f
              • Instruction ID: e3205988bcf07f8501309bf4c1b9a7268c89fd4be7b96647055ebaa80368db06
              • Opcode Fuzzy Hash: 3a62b0a972beee03b812ba7cda6906f401efaaa3c807110fa229ae2f4f41a73f
              • Instruction Fuzzy Hash: 66010433A411049BC331DF18DC00E23B7A8EF91770B254255EAA89B1B2E670EC01E790
              Function 00F9E1D0 Relevance: .1, Instructions: 51COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6c712daa6ef4faf8030e0d118baea1d3f22efe18ce862dd56929ce3921140598
              • Instruction ID: 8a124207e176a60e57ad6ab0d2c0df567d416aa2590665b5c2ee6204ae90943d
              • Opcode Fuzzy Hash: 6c712daa6ef4faf8030e0d118baea1d3f22efe18ce862dd56929ce3921140598
              • Instruction Fuzzy Hash: C211AD32641240EFDB15EF19DD91F56BBB8FF48B94F200065F9059B662C239ED01DA90
              Function 00F26259 Relevance: .1, Instructions: 51COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4604ac9cb1548c4627a4798b549e42d941da3f63a46fee1d919eb5d1044af61c
              • Instruction ID: 6a14cabf5b4a748331274b8bcc60b786b4098a06b847c1f21064a1058261ee91
              • Opcode Fuzzy Hash: 4604ac9cb1548c4627a4798b549e42d941da3f63a46fee1d919eb5d1044af61c
              • Instruction Fuzzy Hash: C8115A71941228ABDF65EB64CD42FE9B3B4EB48720F504194B318AA0E1DB749E85EF84
              Function 00F2208A Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
              • Instruction ID: 4ec8f30eb7d5b3026b893a14912c29e9322722a3152bbaebde84cc6f926dbe5c
              • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
              • Instruction Fuzzy Hash: 7C012833A001209BDF51CE59E880B527766FFC4720F1540A5ED05CF256DA71DC81F390
              Function 00FA6050 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 06c4f5d7150bd6da237e178bc459120db58f00a741d317b56c6176cbfa6110f8
              • Instruction ID: fffd46e5702a2d351e03becbffe62e4328eab8bd577a8b2d04deecfdb4008b5c
              • Opcode Fuzzy Hash: 06c4f5d7150bd6da237e178bc459120db58f00a741d317b56c6176cbfa6110f8
              • Instruction Fuzzy Hash: 961129B3900019ABCB11DB94CC85EEFBB7CEF49358F044166E906E7211EA34EA55DBE0
              Function 00FB6500 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2104c95ecd35ce97cf9bcdd8e3ea9267803d82252a07a41058e9c0e219fe518c
              • Instruction ID: 24e7dfe801a720b88d18bc8aa3a391b175c77b8b0386356675ee60b6ce9baa99
              • Opcode Fuzzy Hash: 2104c95ecd35ce97cf9bcdd8e3ea9267803d82252a07a41058e9c0e219fe518c
              • Instruction Fuzzy Hash: D711A1326441459FC721CF59D800BE6B7B9FB9A314F1C8159E848CB315D736EC81EBA0
              Function 00FAC810 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8d38abd7a54ed642d879cbfffe4215111309a1ccfb07766980412efc8a5cb046
              • Instruction ID: 86fb9fb3ee0c696e1f2f4e11374633477e0a0372cd38b51291af86fb88ecabea
              • Opcode Fuzzy Hash: 8d38abd7a54ed642d879cbfffe4215111309a1ccfb07766980412efc8a5cb046
              • Instruction Fuzzy Hash: 9811E8B5E00209ABCB04DFA9D541AAEB7F8FF49350F10806AB905E7351D678EE019BA4
              Function 00FCEA60 Relevance: .0, Instructions: 50COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 370dca3536f44bfaf0c7452156a10397d788e0a1e4ff760b6f320e67d4069add
              • Instruction ID: a5fbfbaf26fa1c10f28f887c793a7acedcb20c4883672f7a86240b43c26fadeb
              • Opcode Fuzzy Hash: 370dca3536f44bfaf0c7452156a10397d788e0a1e4ff760b6f320e67d4069add
              • Instruction Fuzzy Hash: C501B1329402119FC732AE11CA42F2ABBA9FF517B0B18442EF5445B211CB2D9D41EB91
              Function 00F620F0 Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9fde4845f7867b79e0d6924f82c7a9efa31e22016e383418472609df3418e59d
              • Instruction ID: 5197e97477103f09d25adbe5c84bc5cc767cf1f10454b357610ce6a8c3944a75
              • Opcode Fuzzy Hash: 9fde4845f7867b79e0d6924f82c7a9efa31e22016e383418472609df3418e59d
              • Instruction Fuzzy Hash: 9E116971A0120CABDF05EFA4CC51FAE7BB5EB49750F104059F9019B290DB39AE11EB90
              Function 00F1C020 Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
              • Instruction ID: a6ae444dceca4c70d161a79fd54c71eadf4e69a504cb237ccf6973e83932f679
              • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
              • Instruction Fuzzy Hash: 9C01F532600744DFDB229665D840FA777E9FFC5320F54841AA94ACB540DA74E841EB91
              Function 00F5E5CF Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c6f1e3d71aba9939d85d82efb32f3c92e4d5daf5c12592c0dbcd8fdabb97d93
              • Instruction ID: 79cf91e1dbe01ccf087816df1f0aada3661e955b7e381fe99487f74e777e1391
              • Opcode Fuzzy Hash: 9c6f1e3d71aba9939d85d82efb32f3c92e4d5daf5c12592c0dbcd8fdabb97d93
              • Instruction Fuzzy Hash: 8B018F72601A00BBD651AB69CD81E57B7ACFB857B4B040629B90493652DB6CED01D6A0
              Function 00FB69C0 Relevance: .0, Instructions: 49COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 88f9d3830d50441a9cc441481d99ee4eb46f3d5bc4a016a95a7787ed0b69c7a9
              • Instruction ID: cd4d165f523decbd3b2434cfee7a9c007e131aa64005839e3afc4fb39f7a73b2
              • Opcode Fuzzy Hash: 88f9d3830d50441a9cc441481d99ee4eb46f3d5bc4a016a95a7787ed0b69c7a9
              • Instruction Fuzzy Hash: 330128322142059BC720EF698889AA6B7ACEB48724F204129F958D7280E73C9901DBD1
              Function 00FAC460 Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e954165b60af534f9ba6f6df1a2fa6c1acdbe87277c4d4efcebb79059ef3f614
              • Instruction ID: 7aaeee4d2fc06e6720fe76c1854b37937b432fba3b009c9b6fc9ac38317f016f
              • Opcode Fuzzy Hash: e954165b60af534f9ba6f6df1a2fa6c1acdbe87277c4d4efcebb79059ef3f614
              • Instruction Fuzzy Hash: 401157B5A0120CABCF15EFA4C851EAEBBB5EB49350F004059BC0197380DB39EE11EB94
              Function 00FAC97C Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 53213e930d58cecbc2f563b306500dfd91c4121e849b02176e78bb50d1eea4ea
              • Instruction ID: a75f3ffa2762b385e74f3403a56222c07d884cc0c3612cac469aff63885daeaf
              • Opcode Fuzzy Hash: 53213e930d58cecbc2f563b306500dfd91c4121e849b02176e78bb50d1eea4ea
              • Instruction Fuzzy Hash: FA1139B16193089FC700DF69D842A5BBBF4EF9D710F00851AB998D7391E634E900DB92
              Function 00FF4A80 Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
              • Instruction ID: 260eac3962c0b48e848e3bb417c03444ba79c8a90e61226011b638357e3f3f82
              • Opcode Fuzzy Hash: 4be238ecb871e70af7da4c9819feb513cc5cd9ee9a4f29187abed574232cbb68
              • Instruction Fuzzy Hash: 4601B532640A099FD7219E59D841F67B7EAFFC5320F044419E642CB6A0DA78F840E754
              Function 00FACA11 Relevance: .0, Instructions: 48COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: de0527bd3a2f71140801f2210f49edbf2b10d70bdfb8109c0e5115f24a0f966e
              • Instruction ID: f029d05dcc467d312ee26ed03b95b563034e56215a51128ffd60b5397989b017
              • Opcode Fuzzy Hash: de0527bd3a2f71140801f2210f49edbf2b10d70bdfb8109c0e5115f24a0f966e
              • Instruction Fuzzy Hash: ED115BB16193089FC710DF69D841A5BBBF4EF89750F00851EF998D73A1E638E900DB92
              Function 00F3E016 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
              • Instruction ID: 3175d57cd52392dd73fb30763020024d27d373d33b47da53f85ceab20dd9b634
              • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
              • Instruction Fuzzy Hash: 9A017CB26045849FD326871DDA48F2677DCEF45760F0944A2F809CB6D1D6A8DC40EA22
              Function 00F1826B Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4e1c969a330c5b2d386db27063f9c2cf3ac622179626897374b5f4645742d8af
              • Instruction ID: 823d265852f64f546dca86f76061e643a2adb3c14b160c35e42ccd652461930c
              • Opcode Fuzzy Hash: 4e1c969a330c5b2d386db27063f9c2cf3ac622179626897374b5f4645742d8af
              • Instruction Fuzzy Hash: 7201F772B00648DBC715EB65DD11AEEB7B8FF81360F194029A901E7645DE34DD42E390
              Function 00FCEB50 Relevance: .0, Instructions: 46COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 30d9987d4a0382689b127360fcbe7a4003739705af8889f5df8f13681760f40a
              • Instruction ID: 5a67285a4670bcabdaac278375f364b934358a4e8e50345e124c3aa09199b3e7
              • Opcode Fuzzy Hash: 30d9987d4a0382689b127360fcbe7a4003739705af8889f5df8f13681760f40a
              • Instruction Fuzzy Hash: E101F271680701AFC3315B15DD02F16BAA8EF84B60F04042EB2459F391C6B9EC409B44
              Function 00F22582 Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b42cc4323a4af1228c2e22d2714262848ab67eac963592403dfc997e29650206
              • Instruction ID: 3f0dd084ba697f1880584d88c307dfb68d1d948f884a2cad5cda990942646128
              • Opcode Fuzzy Hash: b42cc4323a4af1228c2e22d2714262848ab67eac963592403dfc997e29650206
              • Instruction Fuzzy Hash: B4F0F433A41A20B7C731DB969C41F07BAAAEB84BA0F188029B50597640CA34ED01EAA0
              Function 00F4C073 Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
              • Instruction ID: 533148df3bbb4c71f552159f4e32fe91eec1ada5f95d20c81d9127f2f876ac4e
              • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
              • Instruction Fuzzy Hash: C5F0C2B2A00A10ABD328CF4DDC41E57FBEEDFC0B90F048128A905C7220EA31DD04CB90
              Function 00FF62D6 Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 31c50c21f24474b8ccdcab5ce6e0d4439dba5d3d54b69627b29c2ef1c0671302
              • Instruction ID: d28d05efbcc04563b093c7dc77e378da2bc37c1f12a414ed523ea4a66cc6c0ad
              • Opcode Fuzzy Hash: 31c50c21f24474b8ccdcab5ce6e0d4439dba5d3d54b69627b29c2ef1c0671302
              • Instruction Fuzzy Hash: AA014471E0020DEFCB04DFA9D841AAEB7F8EF48314F50405AF914E7351DA78AE019BA0
              Function 00FF625D Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 32c537558735a2a829994575b63f45a8bdb23cdaa67a70f8e3d38563c4ab8954
              • Instruction ID: 0a467db2c886320a79925e6425020f7986848e7e3dac3ec721f9f412bd565db6
              • Opcode Fuzzy Hash: 32c537558735a2a829994575b63f45a8bdb23cdaa67a70f8e3d38563c4ab8954
              • Instruction Fuzzy Hash: 96012171A1020DABCB04DFA9D851AAEB7B8EF48314F10405AF904E7351D678AA019BA0
              Function 00FF634F Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e2473654ebb81dac339ca78e1638d91696480aa722d1e49f0a75989b3ba438d5
              • Instruction ID: 94f7870a653385d3c52f47d5947fbeacb06413882af520dc18fab9bde0dc2bfd
              • Opcode Fuzzy Hash: e2473654ebb81dac339ca78e1638d91696480aa722d1e49f0a75989b3ba438d5
              • Instruction Fuzzy Hash: 57014475E1020DEFCB04DFA9D951AAEB7F8EF48714F10405AF904E7351DB78AA019BA0
              Function 00F1C310 Relevance: .0, Instructions: 43COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
              • Instruction ID: 21bbd1aa06038204cc9415a342db2b85e7a8ba146d7ce00d5f67a5acfa5cf0b7
              • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
              • Instruction Fuzzy Hash: 40F08B33284A329BC73216594C41BEBB6958FD1BB0F2A8036F119DB640CA688C42BBD1
              Function 00F5CA6F Relevance: .0, Instructions: 42COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
              • Instruction ID: 90269ff46fc4dcd482460b12a99422558e2ed2dca45c74bc289ec66483c3ff13
              • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
              • Instruction Fuzzy Hash: EA01D132A006899FE722D61DD809B59BB98EF427A0F0940A1FE05CB6A2DA7DCD01E650
              Function 00FF61E5 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 231caf8101c7bcd4feb9ca6f0efca17ab3fc997cf9cdd1788be0345afec20dd6
              • Instruction ID: 071c9ccb29bbc8ce21960216d24b5c55b7ff651cbb9fb26eda00241f9652f534
              • Opcode Fuzzy Hash: 231caf8101c7bcd4feb9ca6f0efca17ab3fc997cf9cdd1788be0345afec20dd6
              • Instruction Fuzzy Hash: 65014F71A0124DABCB04DFA9D846AEEB7B8AF48314F14405AF501F7391DB78EA01DB94
              Function 00FA63C0 Relevance: .0, Instructions: 41COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
              • Instruction ID: df87b93f7a0860d77c8de5746e35b8baf44b71e26af1cf1420adfabf03e172a3
              • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
              • Instruction Fuzzy Hash: 94F01D7220001DBFEF019F94DD81DAF7BBDEF493E8B144125FA11A2161D635DE21ABA0
              Function 00FAA4B0 Relevance: .0, Instructions: 40COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d175af74863c48f7290858bb5ed0bf1795b480a459411faab746b1a93fa0aeea
              • Instruction ID: 120f1b6643085da33579bca3e74c452b1a8cdf80257e93339e4b1bda1bfe498b
              • Opcode Fuzzy Hash: d175af74863c48f7290858bb5ed0bf1795b480a459411faab746b1a93fa0aeea
              • Instruction Fuzzy Hash: 51018536500209ABCF229E84DC40EDA3B66FB4C764F0A8101FE1866224C33AD974EB82
              Function 00F1C0F0 Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 61c551871656eff139e6182215971a35bbc194fe7b5d857030ec0ed8b314b12f
              • Instruction ID: 219c22a5316cc4b71f5ac056ff92f3460dff582a1087575c5ab60268c443db5b
              • Opcode Fuzzy Hash: 61c551871656eff139e6182215971a35bbc194fe7b5d857030ec0ed8b314b12f
              • Instruction Fuzzy Hash: 8BF02B727C42017BF31095159C02BB23295D7C0760F65803AEB05AF2C2F970DC8193D4
              Function 00F5656A Relevance: .0, Instructions: 39COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5d6ae09abf962b7602a7d2e2d97e949f5d300ed9c1a952a1cdc397848a0af33a
              • Instruction ID: fab082be5ca64d812c6e7af7382b61d7ca3ee02bcd70871444e75a5ff3960ae1
              • Opcode Fuzzy Hash: 5d6ae09abf962b7602a7d2e2d97e949f5d300ed9c1a952a1cdc397848a0af33a
              • Instruction Fuzzy Hash: 9F01A471A406849FE7329B38CD59F2533A4AB51B54F9D0190BE11CBAD6E72CE802F610
              Function 00FC437C Relevance: .0, Instructions: 37COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
              • Instruction ID: 292d94a2d0ae8cf8eb51d0b5bb0d2217204fbecc945afa08878c778705f89f97
              • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
              • Instruction Fuzzy Hash: B4F0E931B41D9347DB35EE2A8D32F2EB6559FC0F21B15062CA801CB680DF20EC00B790
              Function 00FAC89D Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 81b424d57d115a50a90d6aef5c84701dc8b097982d2ec74801ccbe7bb98f338f
              • Instruction ID: 4780680fd4a49938888dd366aef4e396bc84ec613aa79469c2950f153276dde4
              • Opcode Fuzzy Hash: 81b424d57d115a50a90d6aef5c84701dc8b097982d2ec74801ccbe7bb98f338f
              • Instruction Fuzzy Hash: 96F0C2B16093049FC310EF28C842E1BB7E4FF89710F40465AB898DB395EA38EA00D796
              Function 00FAE872 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
              • Instruction ID: 46e5a41ef0bf993d9fd51c35a2bf4db9657ffd86d89dbd49c611a068a3507b33
              • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
              • Instruction Fuzzy Hash: F2F082B3B516119BD3319A49DC80F16B3B8EFC6BB0F2A0065B504AB260C768EC01E7D0
              Function 00F50854 Relevance: .0, Instructions: 35COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
              • Instruction ID: ce28eedef013dd8efa4e1ae579dd689a5f14dc41aee01e5cb28950f4e8911b68
              • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
              • Instruction Fuzzy Hash: C1F0E972610204AFE714DF25CC01F96B3E9EF98361F1480789945D71A0FAB4EE41E694
              Function 00FAC912 Relevance: .0, Instructions: 34COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6b377c0c332d71ec816ab5c69b381b8ab4800bceb436ff1dfca4f520968de70c
              • Instruction ID: 268554e069f56bcb61780c62c5fc24f1d685e1165f873777211169b3c5ff50a2
              • Opcode Fuzzy Hash: 6b377c0c332d71ec816ab5c69b381b8ab4800bceb436ff1dfca4f520968de70c
              • Instruction Fuzzy Hash: 73F062B0A0124DEFCB04EF69D515E9EB7B4EF08300F108055B855EB385DA38EB05DB90
              Function 00F247FB Relevance: .0, Instructions: 33COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2fecc270753a9afb9b4fa20e3f321fd0e13c860daae209633ced3734d4de3fd4
              • Instruction ID: ab58ad8e9b20677975b57699a7b307b4eddf11e1d70ebe12ffab5b9ff1ca2c61
              • Opcode Fuzzy Hash: 2fecc270753a9afb9b4fa20e3f321fd0e13c860daae209633ced3734d4de3fd4
              • Instruction Fuzzy Hash: 25F09032D226F49FD7218B58E444BE27BD4AB00770F1D496AD95987511C7E8FC80E651
              Function 00FE0115 Relevance: .0, Instructions: 32COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b62552be0d47ae483a00d52c6f93da6f4e86304b375b455d3d8cb647ce9b230d
              • Instruction ID: 57ae8f85d142c0ea20c5060632a55e6d54e59ecf271eb1f55838529ac27b0344
              • Opcode Fuzzy Hash: b62552be0d47ae483a00d52c6f93da6f4e86304b375b455d3d8cb647ce9b230d
              • Instruction Fuzzy Hash: 6AF082768166C406CB315B29BC523D17B6AA746324F1E144AD4E15F206C9FE89C3E324
              Function 00F5C5ED Relevance: .0, Instructions: 31COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0e05e22f011343de6eefd5ab0aae67b738808ba5b972e94106fcb3f7f4cf7c3c
              • Instruction ID: b697e1a99dc7819a02abb42518ed7075163097441dcc3eb032685a8a2a0709de
              • Opcode Fuzzy Hash: 0e05e22f011343de6eefd5ab0aae67b738808ba5b972e94106fcb3f7f4cf7c3c
              • Instruction Fuzzy Hash: 9AF0E2769117549FC3229718C148B6173D4AB40FB2F19A565DE0F87512C3A4DE89EAD0
              Function 00F62619 Relevance: .0, Instructions: 31COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
              • Instruction ID: 5052988d93fa39af5667b853ed106479ef9df0c24157c912e19c7f7a477f11d8
              • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
              • Instruction Fuzzy Hash: 33E0D832300A002BD7119E59CCC1F47776EEFC2B20F040079B5045F252C9E6DD0997A4
              Function 00FB6030 Relevance: .0, Instructions: 29COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
              • Instruction ID: d363ac5bd129ee74ad3c6d9d7145a9730a4ac5629995cdfbbc692ca08802b49b
              • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
              • Instruction Fuzzy Hash: 67F01C725046049FE3209F07D944BA2B7A8EB457A4F558025E609DB561D37DEC40EFA4
              Function 00F20710 Relevance: .0, Instructions: 28COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
              • Instruction ID: ca8d04e58e8d71c82da19c647c14648d2bbac2fdf2bba63d7a10b876b47ef2ad
              • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
              • Instruction Fuzzy Hash: 47F0E53B6043649BDB15CF19E040A957BA5EB45360F144096F8468B342DB39FD81EB41
              Function 00F549D0 Relevance: .0, Instructions: 28COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
              • Instruction ID: 112660ee3717b77009c25cf586bfa8ff9ecc644a893b43830a66d3c6ea6e3183
              • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
              • Instruction Fuzzy Hash: AAE02233284146ABC3601E148800B2A7AA59BC07B2F110028EB088B140DB78ECC4F398
              Function 00FF4164 Relevance: .0, Instructions: 27COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f11325524de612eaa17202e3d50eb6ca5a22719b271ece8f7d685938c33e8449
              • Instruction ID: cea74ddcad606863dc501af22b9593d7ffcd88b871f9cf3bc68316e5a934a0a9
              • Opcode Fuzzy Hash: f11325524de612eaa17202e3d50eb6ca5a22719b271ece8f7d685938c33e8449
              • Instruction Fuzzy Hash: 2DF0A031D255988FD762DB24E540B6373E0AF50734F0A1594D500C7A21C364FC80D650
              Function 00FC678E Relevance: .0, Instructions: 27COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
              • Instruction ID: 2924b44ac878c66f12f2fd1d59baecb2a740083549d8c05baa6a61a9008eaa78
              • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
              • Instruction Fuzzy Hash: A3E02632A00120FBDB219799CE02F9BBABCDF80FA5F050058BA00E70D0D930EE00E6D0
              Function 00FF08C0 Relevance: .0, Instructions: 25COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
              • Instruction ID: 0086e3595f8e30bb52a18a7a38b223c67ac855839a1ecdea65375b4629c75426
              • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
              • Instruction Fuzzy Hash: 12E09B32A403588BCB248A19C541B73B7ECEFA57B1F258069DA0547623C631FC42E6D0
              Function 00FDA456 Relevance: .0, Instructions: 23COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
              • Instruction ID: 6363630cb50936f47b6c9e5d33234d506f5bd26984c51ffb95605e44da6636f3
              • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
              • Instruction Fuzzy Hash: 00E06D31010A10DFD732AB25DC09B5277E1BF40721F188829A096115B1C7B89C80EA84
              Function 00F225E0 Relevance: .0, Instructions: 23COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: b98be006c015c86bf8a949285e02b5ec5dce74d580a3140cc71d3a9dc0dcf49e
              • Instruction ID: 073439ceef9bc2e65a49634b145d12e33fc9b691b0b68e1d4c5db14d8a4e2d0c
              • Opcode Fuzzy Hash: b98be006c015c86bf8a949285e02b5ec5dce74d580a3140cc71d3a9dc0dcf49e
              • Instruction Fuzzy Hash: D8E09232100954ABC321FB29ED02F8B7B9AEB94360F014515B15557191CB79A950D784
              Function 00FA4000 Relevance: .0, Instructions: 22COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
              • Instruction ID: 0310028eb1471a16b9192dae325986f79a5e4d2f4ef0cddaf4e3fda262a733cf
              • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
              • Instruction Fuzzy Hash: DDE0C2747003058FD715CF19C040B6277B6BFD6B20F28C068A9488F205EB72E842EB40
              Function 00F5CA38 Relevance: .0, Instructions: 22COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6134efd3287876eec03691b77e1e56ceff529b46b21d4b315831a09287239ed1
              • Instruction ID: f33edb013a8fa29c20ca2f4edeb1d5578f570d8bfefae4de851462853d70e73c
              • Opcode Fuzzy Hash: 6134efd3287876eec03691b77e1e56ceff529b46b21d4b315831a09287239ed1
              • Instruction Fuzzy Hash: 8ED0C2328811206ECB24E114BC24F933E599B41721F014860FA0992010D56CCC85B2C4
              Function 00F1823B Relevance: .0, Instructions: 21COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
              • Instruction ID: c665d7ce518f898c8e9707219f3029c6c7289f99568d30aed67faa74cc21b5fb
              • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
              • Instruction Fuzzy Hash: BCE0C232400A50EFDB322F11DD01F9177A1FFA8BA0F20482AF085160A58B78ACC2FB44
              Function 00F22050 Relevance: .0, Instructions: 20COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 064e8f05e9f7d1a9f84664962dc26a1e389a13ab364047bae14be3b885233427
              • Instruction ID: dab14adb2aca192b0e7f0f970f584bc9fe06abe9817c0d04754791906b2fbc20
              • Opcode Fuzzy Hash: 064e8f05e9f7d1a9f84664962dc26a1e389a13ab364047bae14be3b885233427
              • Instruction Fuzzy Hash: 1CE08C321004606BC211FA5DED02F4A779AEB943A0F010221B15197291CA69AD40D794
              Function 00F58A90 Relevance: .0, Instructions: 20COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
              • Instruction ID: c7b3de9d9f10d710f50be94a560e9f7372e51e2fd9ca5f02372406d28b4d29a9
              • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
              • Instruction Fuzzy Hash: 32E02633110A0497C328DE18C411B7273A4EF44731F08423EAA1347380C934E808D794
              Function 00F76AA4 Relevance: .0, Instructions: 17COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
              • Instruction ID: 4ad0ea140539b12f849509fcb32e82de2df5c1b00e63b981c9370fd265cce676
              • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
              • Instruction Fuzzy Hash: EDD05E36511A50AFC3329F1BEE00C13BBF9FBC4B60705062FA44593920C674AC06DBA0
              Function 00F5E59C Relevance: .0, Instructions: 16COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
              • Instruction ID: 150e57b9d1b76eeee858cb78ec0f8c473964e4fceffd566fb2f5cd6f3df98448
              • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
              • Instruction Fuzzy Hash: FFD0A932608620ABEB32AA1CFC00FC333E8AB88770F060459B008C7050C3A8AC81DA84
              Function 00F9E908 Relevance: .0, Instructions: 16COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
              • Instruction ID: 82c6a63528ee8a2a3bade5f5d8833686d5f0db3407741f4031edfd9ae2297d7e
              • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
              • Instruction Fuzzy Hash: C3E0EC359506849BDF12DF59DA40F5AB7F5BB84B50F151054A0486B661C628AD00DB40
              Function 00F1A0E3 Relevance: .0, Instructions: 15COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
              • Instruction ID: 314887572c1dc1b23eb075bdd7c5df3f822ea021f5bb5d631df2c0482bd17622
              • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
              • Instruction Fuzzy Hash: E7D01233617070A7CB2996656D14FA779559B85BA4F1A006D740AA3900C5198C82F6E1
              Function 00F5A830 Relevance: .0, Instructions: 14COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
              • Instruction ID: 6696bed258bdea5182edf23ba6acf5434442845bb4695951c2db6eea90d84075
              • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
              • Instruction Fuzzy Hash: 62D012371D054CBBCB11DF65DC02F957BA9E754BA0F445020B504875A1C63EE950D584
              Function 00F5CA24 Relevance: .0, Instructions: 14COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 222205709aa679713c196ebc111819f1c75d63bea3fad4c8c18da26d3276957f
              • Instruction ID: f2b4869a136d732b360799002e32caa94b9c3e79d5f4d97d6a5ab8317f85e810
              • Opcode Fuzzy Hash: 222205709aa679713c196ebc111819f1c75d63bea3fad4c8c18da26d3276957f
              • Instruction Fuzzy Hash: E6D0A731901106CFDF26CF08C920E2E3AB0EF24B92F400068EB0151020D72DEC02F640
              Function 00F5C700 Relevance: .0, Instructions: 12COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
              • Instruction ID: 3a42ca4a64438ccf40a6d53abc3de0eb30844774c988b17cca49c835be7e08d1
              • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
              • Instruction Fuzzy Hash: C8C08C33290648AFC712EF98DD02F027BE9EB98B90F000021F3048B671C639FD20EA84
              Function 00F40310 Relevance: .0, Instructions: 11COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
              • Instruction ID: a92619d84c4acc5baa6e0af23c602ab74a85c9b584d464dc6a758b2c2297101a
              • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
              • Instruction Fuzzy Hash: 23D01236100248EFCB01DF41C890DAA7B2AFBC8710F108019FD19076118A35ED62DA50
              Function 00F20750 Relevance: .0, Instructions: 9COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
              • Instruction ID: 815180baecf95ffc57ff753d54278832697a806c6fcaa50e00e84923119b881f
              • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
              • Instruction Fuzzy Hash: 16C04C797015458FCF15DB19D694F4577E4F744760F1548D1E805CB721E628ED01DA11
              Function 00F64340 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 9f6f981e731fd97ae191c07adadac704c0ca766b964b6db29a9bd7ac5f015692
              • Instruction ID: 61d233bdabd8ee13914afa555c8c4e679220601cf58d7513649a67504bbb1b45
              • Opcode Fuzzy Hash: 9f6f981e731fd97ae191c07adadac704c0ca766b964b6db29a9bd7ac5f015692
              • Instruction Fuzzy Hash: AD90023164580022A24071588888546400597E0341B55C033E0464554D8E188A576362
              Function 00F64650 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 54e50f520431e3967c96638485c162e5305e4397cceb0f90d3185e95d5a0b528
              • Instruction ID: 77eccbcaa0a45660ece818484d2b6e2a0a7fd2a42fc9be3103f43e86882e891a
              • Opcode Fuzzy Hash: 54e50f520431e3967c96638485c162e5305e4397cceb0f90d3185e95d5a0b528
              • Instruction Fuzzy Hash: 5C90026164150052524071588808406600597E1341395C137A0594560D8A1C8956A26A
              Function 00F62AF0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7e3f839bcc0afdfcc8ad517cf5097d53ed114e29f1fc0824e5c148285d45d21a
              • Instruction ID: 84305c7630571e15aa5421182aae9a4e4edd492c61032b30c1d91c5dccc39e4a
              • Opcode Fuzzy Hash: 7e3f839bcc0afdfcc8ad517cf5097d53ed114e29f1fc0824e5c148285d45d21a
              • Instruction Fuzzy Hash: 65900225261400121245B558460850B044597D6391395C037F1456590DCA2589666322
              Function 00F62AD0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 281632a2f927b4ca554958e92b8dce1ca72b05e3b791daa7af053c455024cc66
              • Instruction ID: 93e70c8ffee2d561de7eac3ff201355cfd34bfb817f10b4ad791e5409a7180ac
              • Opcode Fuzzy Hash: 281632a2f927b4ca554958e92b8dce1ca72b05e3b791daa7af053c455024cc66
              • Instruction Fuzzy Hash: 3D900225251400131205B5584708507004687D5391355C033F1055550DDA2589626122
              Function 00F62AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1f2ad73a3f02ff97d4e47fb4d7e44f78375c5f2e5f77a8cae770117afdf5c0e9
              • Instruction ID: 0e1049d65488b94115c785dc7adc61b4df3dd9140cafc524ed53bd046cb828c7
              • Opcode Fuzzy Hash: 1f2ad73a3f02ff97d4e47fb4d7e44f78375c5f2e5f77a8cae770117afdf5c0e9
              • Instruction Fuzzy Hash: C69002A1241540A25600B258C408B0A450587E0341B55C037E1094560DC9298952A136
              Function 00F62BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 98340e807bd565155251c83139248a8168ac70db1b5ef3ac743e282a28ce5c3a
              • Instruction ID: bf1c8f6a241f2e9b0d293739941b17760972a386bca5d56ca97d850320455340
              • Opcode Fuzzy Hash: 98340e807bd565155251c83139248a8168ac70db1b5ef3ac743e282a28ce5c3a
              • Instruction Fuzzy Hash: AE90023124140812E2807158840864A000587D1341F95C037A0065654ECE198B5A77A2
              Function 00F62BE0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5c69a5c49888e74cf3e45c4aae50768d5d47c5dbe675bbe929395772f55f655d
              • Instruction ID: b083a8ad507bddf0a2efe921d8a2248c50c89730d52628806dabe5054c8dad6c
              • Opcode Fuzzy Hash: 5c69a5c49888e74cf3e45c4aae50768d5d47c5dbe675bbe929395772f55f655d
              • Instruction Fuzzy Hash: C690023124544852E24071588408A46001587D0345F55C033A00A4694E9A298E56B662
              Function 00F62BA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b2c97f577812cc93777f6f312027bcfd4ca25f2ebfcff3da3cbf8907d9cfc7e4
              • Instruction ID: 698626a8d66b56895a0bfa8d0cf75c0fad75c1895f02be0ffadbcdf95c5afeb6
              • Opcode Fuzzy Hash: b2c97f577812cc93777f6f312027bcfd4ca25f2ebfcff3da3cbf8907d9cfc7e4
              • Instruction Fuzzy Hash: B090023164540812E25071588418746000587D0341F55C033A0064654E8B598B5676A2
              Function 00F62B80 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e86c979b888fbbf02da9382a88786c7e717a111346a098584462ea859b41880b
              • Instruction ID: 659307e5b731679705fe421d3c98c410f6a23af3db77bb735db3df80ffe6bf46
              • Opcode Fuzzy Hash: e86c979b888fbbf02da9382a88786c7e717a111346a098584462ea859b41880b
              • Instruction Fuzzy Hash: D990023124140812E20471588808686000587D0341F55C033A6064655F9A6989927132
              Function 00F62CF0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 26175fecab513009fbf9b8f49ecb5ae36f11fa5390ed3988a3bbe6d7e60cb412
              • Instruction ID: 8f13783a8da8957b616f71256e78baf83bebe19c506247402866dfe96b8e770b
              • Opcode Fuzzy Hash: 26175fecab513009fbf9b8f49ecb5ae36f11fa5390ed3988a3bbe6d7e60cb412
              • Instruction Fuzzy Hash: 4290023124140413E2007158950C707000587D0341F55D433A0464558EDA5A89527122
              Function 00F62CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7b2e83c2d8ebb1ac23e5678878164086abcbc79ccfdeeae63635de67a5e55deb
              • Instruction ID: 21d5b921469f6c30b1cc3424349405e49d3f07397b6db47623ef9e60888d36d4
              • Opcode Fuzzy Hash: 7b2e83c2d8ebb1ac23e5678878164086abcbc79ccfdeeae63635de67a5e55deb
              • Instruction Fuzzy Hash: 7490022164540412E2407158941C706001587D0341F55D033A0064554ECA5D8B5676A2
              Function 00F62CA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 965f9645d7ff8c66aaee2eda09df9bbcae1b469471636f0a498ae1ab293331f3
              • Instruction ID: 13a58f6e5183360f532e2b4a6c0bdc1eccd561a9b81230311e4348f44f9f2208
              • Opcode Fuzzy Hash: 965f9645d7ff8c66aaee2eda09df9bbcae1b469471636f0a498ae1ab293331f3
              • Instruction Fuzzy Hash: 5890023124140412E2007598940C646000587E0341F55D033A5064555FCA6989927132
              Function 00F62C60 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 96b2bfc1b8e09ef8389bb659f5023ba8967bc647d508cbef860c6c0830830377
              • Instruction ID: fcf9b212da93393d667475b80f528070d9213ebd8fab64c22620b6405d0dfcfd
              • Opcode Fuzzy Hash: 96b2bfc1b8e09ef8389bb659f5023ba8967bc647d508cbef860c6c0830830377
              • Instruction Fuzzy Hash: DB90023124140852E20071588408B46000587E0341F55C037A0164654E8A19C9527522
              Function 00F62DD0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: dd5d03a993a8406b5af05a0e21739c10790a87a18b862a8efd074e0f4a8cfb72
              • Instruction ID: daedb5fd7da95a45a10d071d7557fcd0f02d5c459855572c94f00f07519ece8d
              • Opcode Fuzzy Hash: dd5d03a993a8406b5af05a0e21739c10790a87a18b862a8efd074e0f4a8cfb72
              • Instruction Fuzzy Hash: 05900221282441626645B1588408507400697E0381795C033A1454950D892A9957E622
              Function 00F62DB0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 92d31b1d2c831f17d362be54496a33b5362b20ca0c648b7a601ce2fcfc056af4
              • Instruction ID: a2b350cd44715d2058a9f05543f675bb60d4c371067b0c45fb2010f038c5f367
              • Opcode Fuzzy Hash: 92d31b1d2c831f17d362be54496a33b5362b20ca0c648b7a601ce2fcfc056af4
              • Instruction Fuzzy Hash: 5B90023128140412E24171588408606000997D0381F95C033A0464554F8A598B57BA62
              Function 00F62D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 1244a44cf26a6d7a3c0ffee3fa189fa6b9ec3e403f0077aff5e026a61e028792
              • Instruction ID: 3e5800e7e4e1d0f24035f2659bb6f17f964621412465bc685519163ff4843bff
              • Opcode Fuzzy Hash: 1244a44cf26a6d7a3c0ffee3fa189fa6b9ec3e403f0077aff5e026a61e028792
              • Instruction Fuzzy Hash: EB90022134140013E2407158941C6064005D7E1341F55D033E0454554DDD1989576223
              Function 00F62D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b133e18f205db776bb9b79716ee1064667cefe8d70e9c3d6049c6d999cd31ac9
              • Instruction ID: 6f1f351e9c040753b1ab85d26febedeb633d7ff00839d87121f7bf8e0ad3c338
              • Opcode Fuzzy Hash: b133e18f205db776bb9b79716ee1064667cefe8d70e9c3d6049c6d999cd31ac9
              • Instruction Fuzzy Hash: 9190022925340012E2807158940C60A000587D1342F95D437A0055558DCD19896A6322
              Function 00F62D00 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 331de63ae2461213d10a5560acd123dcc4d302753ffac44576065f242841abed
              • Instruction ID: 01fd423267e34f5a297ae58378da0b5f909032c7afb816449ed443f6386d795f
              • Opcode Fuzzy Hash: 331de63ae2461213d10a5560acd123dcc4d302753ffac44576065f242841abed
              • Instruction Fuzzy Hash: A090022124544452E2007558940CA06000587D0345F55D033A10A4595ECA398952B132
              Function 00F62EE0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 47c339e0de10d0e60e2de0b6783a5515a1ee9f7ef6587aed509f12e7bf7733e4
              • Instruction ID: 1bf5229f39239456312e406cf28b9408c5ddfedc7807429f45505d911170b298
              • Opcode Fuzzy Hash: 47c339e0de10d0e60e2de0b6783a5515a1ee9f7ef6587aed509f12e7bf7733e4
              • Instruction Fuzzy Hash: 4590026124180413E24075588808607000587D0342F55C033A20A4555F8E2D8D527136
              Function 00F62EA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2729cd37ed7eeab2121b1ff163b81fc0dca6e6dd83af35997b87d7c82e442164
              • Instruction ID: ee74edc0e2ca57655a06dbe5ae0dcaf0031bfcc0a5486fca504c72f7e97fcba6
              • Opcode Fuzzy Hash: 2729cd37ed7eeab2121b1ff163b81fc0dca6e6dd83af35997b87d7c82e442164
              • Instruction Fuzzy Hash: 2790027124140412E24071588408746000587D0341F55C033A50A4554F8A5D8ED67666
              Function 00F62E80 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 651f52961dbe6220ad0fddd2c0df5e50750ca153985afe658b98300951bddd71
              • Instruction ID: 9462c04dc163d67bc344eea22fce073011adbc79f995917182522c7e890362bd
              • Opcode Fuzzy Hash: 651f52961dbe6220ad0fddd2c0df5e50750ca153985afe658b98300951bddd71
              • Instruction Fuzzy Hash: 6D90022164140512E20171588408616000A87D0381F95C033A1064555FCE298A93B132
              Function 00F62E30 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5cb8a7f8e6d753cc264cd7d695b1209e42bb7a630e540f9cc3bc3bc2bf96a96d
              • Instruction ID: c3c81de86e0cc385ab29a41bde3757cde9e5b5e44f53338a7bf600c8828452ed
              • Opcode Fuzzy Hash: 5cb8a7f8e6d753cc264cd7d695b1209e42bb7a630e540f9cc3bc3bc2bf96a96d
              • Instruction Fuzzy Hash: 6890022134140412E202715884186060009C7D1385F95C033E1464555E8A298A53B133
              Function 00F62FE0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: b05cc6077a0d1d1b5a82739851aa9f10ce4820c39bfae088337389a9b4a79292
              • Instruction ID: 6320a6a81f26006ee3e6318b8e368d56ea161dea1def7ea876c0e066592c0b2c
              • Opcode Fuzzy Hash: b05cc6077a0d1d1b5a82739851aa9f10ce4820c39bfae088337389a9b4a79292
              • Instruction Fuzzy Hash: E1900221251C0052E30075688C18B07000587D0343F55C137A0194554DCD1989626522
              Function 00F62FB0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 45d56114ba100fe378f436447b9090073f41bdf1106c13c4380a73f6d86bc9ad
              • Instruction ID: cdf0908f2c18555c575a8bb9b708ba068f2e722cc5b00731d83707853496c3fa
              • Opcode Fuzzy Hash: 45d56114ba100fe378f436447b9090073f41bdf1106c13c4380a73f6d86bc9ad
              • Instruction Fuzzy Hash: E79002216414005252407168C8489064005ABE1351755C133A09D8550E895D89666666
              Function 00F62FA0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 5eb1ea770815a882f2d72d26104e2f9a43f1f030300adc951579468c3397955e
              • Instruction ID: 30d9d4efbeb0acf14a54389c7034f500f2e5f3bbbcd265b0ec280498a04e6a2d
              • Opcode Fuzzy Hash: 5eb1ea770815a882f2d72d26104e2f9a43f1f030300adc951579468c3397955e
              • Instruction Fuzzy Hash: 0990023124180412E2007158880C747000587D0342F55C033A51A4555F8A69C9927532
              Function 00F62F90 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 649a7eb9ec40750d5ab5808a20572928e6d38a30b54d119dc4df3f23c0046a46
              • Instruction ID: 95bce1bfdf8cc36ee1047b99139e530bf9b995dcf75e7d29742b52030ae435d8
              • Opcode Fuzzy Hash: 649a7eb9ec40750d5ab5808a20572928e6d38a30b54d119dc4df3f23c0046a46
              • Instruction Fuzzy Hash: 9890023124180412E2007158881870B000587D0342F55C033A11A4555E8A2989527572
              Function 00F62F60 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 97e88e3f0c5c48220637b522f387da862b1774fc4bb25b197785750054d42950
              • Instruction ID: a08df123ae3059e0e18790c038575a50126d3c9e2a3dfc3d8c158bb71f4d9488
              • Opcode Fuzzy Hash: 97e88e3f0c5c48220637b522f387da862b1774fc4bb25b197785750054d42950
              • Instruction Fuzzy Hash: FC90026125140052E20471588408706004587E1341F55C033A2194554DC92D8D626126
              Function 00F62F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 58a715d351511abad0fdc40462c318c9601b740f7d85e76feacd3c7f04f3cf79
              • Instruction ID: 768cecf97923f5a01ffd62a66e904b53ed212fa8152e607ea1e0d5c9c4e5c5b1
              • Opcode Fuzzy Hash: 58a715d351511abad0fdc40462c318c9601b740f7d85e76feacd3c7f04f3cf79
              • Instruction Fuzzy Hash: 4290026138140452E20071588418B060005C7E1341F55C037E10A4554E8A1DCD537127
              Function 00F63090 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0b316bca1a2a63a46db25520466c537a49faf8dfac76e9d669db17f604e1c32f
              • Instruction ID: 9fcc10ba89276e25c088f282d07b44a6a1b3cff10108c166bc4caf59bb9745ee
              • Opcode Fuzzy Hash: 0b316bca1a2a63a46db25520466c537a49faf8dfac76e9d669db17f604e1c32f
              • Instruction Fuzzy Hash: 7D90022128140812E2407158C4187070006C7D0741F55C033A0064554E8A1A8A6676B2
              Function 00F63010 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: bb9fc560d35a6b2e8cf99ec1cc33b392a20939164b104963b68e280fb1ad9c60
              • Instruction ID: d2aed7ce460c90b247cf0f8c407b3f53c40a26b297c4722126d2794dc6c319b7
              • Opcode Fuzzy Hash: bb9fc560d35a6b2e8cf99ec1cc33b392a20939164b104963b68e280fb1ad9c60
              • Instruction Fuzzy Hash: 3390022124184452E24072588808B0F410587E1342F95C03BA4196554DCD1989566722
              Function 00F639B0 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: f0de20a1a7059b03f5fc3f7eb9b88457fcd1aae82040c42d60a145837d15e87e
              • Instruction ID: 50431f4d50565d1b7234b2f3b707f5317573c9f1af4f2b553ae4f57c7f6904c4
              • Opcode Fuzzy Hash: f0de20a1a7059b03f5fc3f7eb9b88457fcd1aae82040c42d60a145837d15e87e
              • Instruction Fuzzy Hash: C790022128545112E250715C84086164005A7E0341F55C033A0854594E895989567222
              Function 00F63D70 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 0f93fa5fb0d1999aa968135645f5e3accb5a6eef6118b213315ac4f8fb3f20f9
              • Instruction ID: e4027bafcaace1454af109b49397dd329fd547fa816fa18627a96bb1fb40d3c2
              • Opcode Fuzzy Hash: 0f93fa5fb0d1999aa968135645f5e3accb5a6eef6118b213315ac4f8fb3f20f9
              • Instruction Fuzzy Hash: DC90023524140412E61071589808646004687D0341F55D433A0464558E8A5889A2B122
              Function 00F63D10 Relevance: .0, Instructions: 4COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7302f4fb52d8a1ad4b0e6c08d521830219a6e7299bb3d7741f9c4c47715aa24e
              • Instruction ID: 3fdbc643f0eedef3e7faab81d2210ef65b0487ae50a75f387746191e971819be
              • Opcode Fuzzy Hash: 7302f4fb52d8a1ad4b0e6c08d521830219a6e7299bb3d7741f9c4c47715aa24e
              • Instruction Fuzzy Hash: 7490023124240152A64072589808A4E410587E1342B95D437A0055554DCD1889626222
              Function 00F62C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
              • Instruction ID: f1714d48c5e40295d540e066429b6ff65e6101ec3c81c223ddb811f5147d110e
              • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
              • Instruction Fuzzy Hash:
              Function 00F62890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
              • API String ID: 48624451-2108815105
              • Opcode ID: c57901306be0d625a8a130ff4181c3f4b52d1143c713167d9d943af03313d0df
              • Instruction ID: 81bebf6ef29a0f4cf2a2c436c8be77ca560d6289a796537f859d15af3c550259
              • Opcode Fuzzy Hash: c57901306be0d625a8a130ff4181c3f4b52d1143c713167d9d943af03313d0df
              • Instruction Fuzzy Hash: 2651E7B2E00516AFDF50DBA88C90A7EF7B8BB58310B14C12AE459D7641D634DE40BBE1
              Function 00FD2410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
              • API String ID: 48624451-2108815105
              • Opcode ID: 15d97260a948660afc474210bc32f73380b047f484ebaf2fbf277845f9e56591
              • Instruction ID: 2e7f5d32f56505684022d5e108fe5577e25b1b34ad24ae8a3c31d5a648ba510f
              • Opcode Fuzzy Hash: 15d97260a948660afc474210bc32f73380b047f484ebaf2fbf277845f9e56591
              • Instruction Fuzzy Hash: D8511671A00645AECB60DF5CCC80A7EB7FAAF64310B1C845BE495C3782DA74DE40A7A0
              Function 00F57630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
              Download Yara Rule
              Strings
              • ExecuteOptions, xrefs: 00F946A0
              • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00F94742
              • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00F94725
              • Execute=1, xrefs: 00F94713
              • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00F94655
              • CLIENT(ntdll): Processing section info %ws..., xrefs: 00F94787
              • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00F946FC
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
              • API String ID: 0-484625025
              • Opcode ID: b762e84bc5a300b66f2cb7e82231db67e657915e4d13df3d1f04cf9fea28bf05
              • Instruction ID: 0491db3255397016f4ccdef324e23dba5b557d28db69ac55175553b76fb2fb38
              • Opcode Fuzzy Hash: b762e84bc5a300b66f2cb7e82231db67e657915e4d13df3d1f04cf9fea28bf05
              • Instruction Fuzzy Hash: AE512D31A043196AEF10BBA4FC86FE977A8AF18311F1400A9EA05A71C1D775AE49BF51
              Function 00FF6940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
              • Instruction ID: 18a0bc07555991536b0a941ab0d61a3c04c26a0a9db3df99085ca3310e4ae0b3
              • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
              • Instruction Fuzzy Hash: E9023571608345AFC305DF18C890A6FBBE5EFC8710F148A2DFA898B261DB75E905DB42
              Function 00F6B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: __aulldvrm
              • String ID: +$-$0$0
              • API String ID: 1302938615-699404926
              • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
              • Instruction ID: 3b3950bb6e568398171a57d572470bb58cb6c7b794ab98b38c3198ac8a840a49
              • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
              • Instruction Fuzzy Hash: F881C170E0524A9EDF249E68C8917FEBBB5AF85320F184259E851E7291C7359CC1EB50
              Function 00FD20E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: %%%u$[$]:%u
              • API String ID: 48624451-2819853543
              • Opcode ID: 192a0f93ee2ad77516f8543486fb051aaecf75ace7494b2c85cc3055f6247d80
              • Instruction ID: a8acfe7f33cdf2c641b2d8a728b8373475203dfd7837e0b37561a4d1e9307187
              • Opcode Fuzzy Hash: 192a0f93ee2ad77516f8543486fb051aaecf75ace7494b2c85cc3055f6247d80
              • Instruction Fuzzy Hash: A9215176E00119ABCB50DE79CC41AEEB7F9AF54754F084117E915E3241EB34DA01ABE1
              Function 00F4F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
              Download Yara Rule
              Strings
              • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00F902E7
              • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00F902BD
              • RTL: Re-Waiting, xrefs: 00F9031E
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
              • API String ID: 0-2474120054
              • Opcode ID: 01ab59d69c53bec6e22b6a921e2c0218595fd2e60df4b3a4c2eb388796c9a3de
              • Instruction ID: 42a4091948ba7089082b7e9b163aeeb8b18669746db8d009e72175e37132ffec
              • Opcode Fuzzy Hash: 01ab59d69c53bec6e22b6a921e2c0218595fd2e60df4b3a4c2eb388796c9a3de
              • Instruction Fuzzy Hash: 8FE1B331A047419FD725CF28C885B1ABBE0BF45324F244A2DF9998B2D1DB78D949EB42
              Function 00F5BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
              Download Yara Rule
              Strings
              • RTL: Resource at %p, xrefs: 00F97B8E
              • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00F97B7F
              • RTL: Re-Waiting, xrefs: 00F97BAC
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
              • API String ID: 0-871070163
              • Opcode ID: 6a0b1fb61a276b84c38c2a25ddf6c90f6a7d74224ce1e94e296bd0d66a7cca62
              • Instruction ID: 2d306273b1f49ca0f96d694abf1fa9e98cdb7b2edb10414ac88dcb9087cfbe06
              • Opcode Fuzzy Hash: 6a0b1fb61a276b84c38c2a25ddf6c90f6a7d74224ce1e94e296bd0d66a7cca62
              • Instruction Fuzzy Hash: 774127317047029FDB20DE65CC41B6AB7E5EF85721F100A2DF95ADB280DB30E809AB91
              Function 00F5B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
              Download Yara Rule
              APIs
              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F9728C
              Strings
              • RTL: Resource at %p, xrefs: 00F972A3
              • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00F97294
              • RTL: Re-Waiting, xrefs: 00F972C1
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
              • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
              • API String ID: 885266447-605551621
              • Opcode ID: 5b2fde1c5899349603a3b21bfeeae6431efe8bf44928f866f3b252b1619b4723
              • Instruction ID: c918b7cc3f6dffc5a0eb2f5c05d6a01411f5de8e6759e22dc7e2321b3c02ba5e
              • Opcode Fuzzy Hash: 5b2fde1c5899349603a3b21bfeeae6431efe8bf44928f866f3b252b1619b4723
              • Instruction Fuzzy Hash: E3412532B14302ABDB20DF65CC42B66B7A1FF84721F100619FD55DB281DB31E806ABD1
              Function 00FD2300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID: %%%u$]:%u
              • API String ID: 48624451-3050659472
              • Opcode ID: 52c9acbb555a1a067e3fc4e4141279d84b7192aa0c24d8c0344a53f0676a620b
              • Instruction ID: 7bb405d73f556021b6cb83042be42a7ad70e4df0d78f1cc1836ecd8d9fc7b0b7
              • Opcode Fuzzy Hash: 52c9acbb555a1a067e3fc4e4141279d84b7192aa0c24d8c0344a53f0676a620b
              • Instruction Fuzzy Hash: D031B472A002189FCB60DF28CC40BEEB7B9EF14710F484556E849E3240EB35EE44AFA0
              Function 00F67D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: __aulldvrm
              • String ID: +$-
              • API String ID: 1302938615-2137968064
              • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
              • Instruction ID: b510502c755a9a215e26db1f1916f80f2b2ec516b885d338777591198058776a
              • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
              • Instruction Fuzzy Hash: 9391C671E083069BDF24EF69C881ABEB7B1EF54734F24461AE855E72C0DB348D41A790
              Function 00F29126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID:
              • String ID: $$@
              • API String ID: 0-1194432280
              • Opcode ID: 3b89fcc3d66ea7b1960c5266f7b3df8ea3150e19672ed8d8b839297fe21c2ea2
              • Instruction ID: ee34a520599a1ab30bf4bc6012327a00c0c2c8f0dae9b7a44fd4e5d4a0b87136
              • Opcode Fuzzy Hash: 3b89fcc3d66ea7b1960c5266f7b3df8ea3150e19672ed8d8b839297fe21c2ea2
              • Instruction Fuzzy Hash: D3811B72D002799BDB31DB54CC45BEEB7B4AF08750F0441EAA919B7280E7759E84DFA0
              Function 00FACEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
              Download Yara Rule
              APIs
              • @_EH4_CallFilterFunc@8.LIBCMT ref: 00FACFBD
              Strings
              Memory Dump Source
              • Source File: 0000000D.00000002.2167161985.0000000000EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_13_2_ef0000_Payment TT Copy.jbxd
              Similarity
              • API ID: CallFilterFunc@8
              • String ID: @$@4Cw@4Cw
              • API String ID: 4062629308-3101775584
              • Opcode ID: 2ccd8646e872d5bb412cf8d281638030dd7004e3ca95a0d1d2f645a7ccd645d9
              • Instruction ID: c082dfb048565b1cd574d0b5a54134609d9769df6a38a67c11325482f53898ca
              • Opcode Fuzzy Hash: 2ccd8646e872d5bb412cf8d281638030dd7004e3ca95a0d1d2f645a7ccd645d9
              • Instruction Fuzzy Hash: EA419FB1900218DFCB21DF95CC41AADBBB8FF45B20F00802AF945DB259D779D901EBA1

              Execution Graph

              Execution Coverage:10.7%
              Dynamic/Decrypted Code Coverage:100%
              Signature Coverage:0%
              Total number of Nodes:297
              Total number of Limit Nodes:11
              execution_graph 34664 2d082b0 34665 2d082dd 34664->34665 34678 2d07c70 34665->34678 34667 2d083b1 34668 2d07c70 3 API calls 34667->34668 34669 2d083da 34668->34669 34670 2d07c70 3 API calls 34669->34670 34671 2d08403 34670->34671 34672 2d07c70 3 API calls 34671->34672 34673 2d0842c 34672->34673 34682 2d07c80 34673->34682 34676 2d07c80 3 API calls 34677 2d0847e 34676->34677 34679 2d07c7b 34678->34679 34681 2d0c9c9 34679->34681 34686 2d07f6c 34679->34686 34681->34667 34683 2d07c8b 34682->34683 34697 2d08188 34683->34697 34685 2d08455 34685->34676 34687 2d07f77 34686->34687 34690 1325d88 3 API calls 34687->34690 34691 1328638 34687->34691 34688 2d0cabc 34688->34681 34690->34688 34692 132863d 34691->34692 34694 132890b 34692->34694 34696 132abb1 2 API calls 34692->34696 34693 1328949 34693->34688 34694->34693 34695 132cca0 3 API calls 34694->34695 34695->34693 34696->34694 34698 2d08193 34697->34698 34699 2d0d342 34698->34699 34700 1328638 3 API calls 34698->34700 34701 1325d88 3 API calls 34698->34701 34699->34685 34700->34699 34701->34699 34935 132d380 34936 132d3c6 GetCurrentProcess 34935->34936 34938 132d411 34936->34938 34939 132d418 GetCurrentThread 34936->34939 34938->34939 34940 132d455 GetCurrentProcess 34939->34940 34941 132d44e 34939->34941 34942 132d48b 34940->34942 34941->34940 34943 132d4b3 GetCurrentThreadId 34942->34943 34944 132d4e4 34943->34944 34702 ffd01c 34703 ffd034 34702->34703 34704 ffd08e 34703->34704 34709 2d02c08 34703->34709 34718 2d0115c 34703->34718 34727 2d01e99 34703->34727 34731 2d01ea8 34703->34731 34712 2d02c45 34709->34712 34710 2d02c79 34751 2d01284 34710->34751 34712->34710 34713 2d02c69 34712->34713 34735 2d02d90 34713->34735 34740 2d02e6c 34713->34740 34746 2d02da0 34713->34746 34714 2d02c77 34719 2d01167 34718->34719 34720 2d02c79 34719->34720 34722 2d02c69 34719->34722 34721 2d01284 CallWindowProcW 34720->34721 34723 2d02c77 34721->34723 34724 2d02d90 CallWindowProcW 34722->34724 34725 2d02da0 CallWindowProcW 34722->34725 34726 2d02e6c CallWindowProcW 34722->34726 34724->34723 34725->34723 34726->34723 34728 2d01ece 34727->34728 34729 2d0115c CallWindowProcW 34728->34729 34730 2d01eef 34729->34730 34730->34704 34732 2d01ece 34731->34732 34733 2d0115c CallWindowProcW 34732->34733 34734 2d01eef 34733->34734 34734->34704 34737 2d02db4 34735->34737 34736 2d02e40 34736->34714 34755 2d02e58 34737->34755 34758 2d02e48 34737->34758 34741 2d02e2a 34740->34741 34742 2d02e7a 34740->34742 34744 2d02e58 CallWindowProcW 34741->34744 34745 2d02e48 CallWindowProcW 34741->34745 34743 2d02e40 34743->34714 34744->34743 34745->34743 34748 2d02db4 34746->34748 34747 2d02e40 34747->34714 34749 2d02e58 CallWindowProcW 34748->34749 34750 2d02e48 CallWindowProcW 34748->34750 34749->34747 34750->34747 34752 2d0128f 34751->34752 34753 2d0435a CallWindowProcW 34752->34753 34754 2d04309 34752->34754 34753->34754 34754->34714 34756 2d02e69 34755->34756 34761 2d0429e 34755->34761 34756->34736 34759 2d02e69 34758->34759 34760 2d0429e CallWindowProcW 34758->34760 34759->34736 34760->34759 34762 2d01284 CallWindowProcW 34761->34762 34763 2d042aa 34762->34763 34763->34756 34764 739a510 34765 739a69b 34764->34765 34767 739a536 34764->34767 34767->34765 34768 7399fdc 34767->34768 34769 739a790 PostMessageW 34768->34769 34770 739a7fc 34769->34770 34770->34767 34566 1324668 34567 132467a 34566->34567 34570 1324686 34567->34570 34572 1324778 34567->34572 34569 13246a5 34577 1324204 34570->34577 34573 132479d 34572->34573 34581 1324888 34573->34581 34585 1324878 34573->34585 34578 132420f 34577->34578 34593 1325cf8 34578->34593 34580 1327058 34580->34569 34582 13248af 34581->34582 34583 132498c 34582->34583 34589 1324514 34582->34589 34586 13248af 34585->34586 34587 132498c 34586->34587 34588 1324514 CreateActCtxA 34586->34588 34588->34587 34590 1325918 CreateActCtxA 34589->34590 34592 13259db 34590->34592 34594 1325d03 34593->34594 34597 1325d28 34594->34597 34596 13271d5 34596->34580 34598 1325d33 34597->34598 34601 1325d58 34598->34601 34600 13272ba 34600->34596 34602 1325d63 34601->34602 34605 1325d88 34602->34605 34604 13273ad 34604->34600 34606 1325d93 34605->34606 34608 132890b 34606->34608 34611 132abb1 34606->34611 34607 1328949 34607->34604 34608->34607 34614 132cca0 34608->34614 34619 132aff0 34611->34619 34615 132ccd1 34614->34615 34616 132ccf5 34615->34616 34633 132d268 34615->34633 34637 132d258 34615->34637 34616->34607 34623 132b0e8 34619->34623 34628 132b0d8 34619->34628 34620 132abc6 34620->34608 34624 132b11c 34623->34624 34625 132b0f9 34623->34625 34624->34620 34625->34624 34626 132b320 GetModuleHandleW 34625->34626 34627 132b34d 34626->34627 34627->34620 34629 132b11c 34628->34629 34630 132b0f9 34628->34630 34629->34620 34630->34629 34631 132b320 GetModuleHandleW 34630->34631 34632 132b34d 34631->34632 34632->34620 34634 132d275 34633->34634 34636 132d2af 34634->34636 34641 132d0a0 34634->34641 34636->34616 34639 132d275 34637->34639 34638 132d2af 34638->34616 34639->34638 34640 132d0a0 3 API calls 34639->34640 34640->34638 34642 132d0a5 34641->34642 34644 132dbc0 34642->34644 34645 132d1bc 34642->34645 34646 132d1c7 34645->34646 34647 1325d88 3 API calls 34646->34647 34648 132dc2f 34647->34648 34652 132f9a8 34648->34652 34658 132f9c0 34648->34658 34649 132dc69 34649->34644 34654 132f9f1 34652->34654 34655 132faf1 34652->34655 34653 132f9fd 34653->34649 34654->34653 34656 2d009c0 CreateWindowExW 34654->34656 34657 2d009af CreateWindowExW 34654->34657 34655->34649 34656->34655 34657->34655 34660 132f9f1 34658->34660 34661 132faf1 34658->34661 34659 132f9fd 34659->34649 34660->34659 34662 2d009c0 CreateWindowExW 34660->34662 34663 2d009af CreateWindowExW 34660->34663 34661->34649 34662->34661 34663->34661 34945 132d5c8 DuplicateHandle 34946 132d65e 34945->34946 34771 7397a95 34772 7397a9f 34771->34772 34773 739799c 34771->34773 34776 7398e11 34772->34776 34790 7398e20 34772->34790 34777 7398e3a 34776->34777 34778 7398e42 34777->34778 34804 7399261 34777->34804 34809 739962f 34777->34809 34814 7399c2f 34777->34814 34818 7399518 34777->34818 34825 73993e9 34777->34825 34830 7399369 34777->34830 34840 73992d6 34777->34840 34845 7399487 34777->34845 34849 73996f7 34777->34849 34853 73994d4 34777->34853 34858 73995e0 34777->34858 34778->34773 34791 7398e3a 34790->34791 34792 7398e42 34791->34792 34793 7399369 6 API calls 34791->34793 34794 73993e9 2 API calls 34791->34794 34795 7399518 4 API calls 34791->34795 34796 7399c2f 2 API calls 34791->34796 34797 739962f 2 API calls 34791->34797 34798 7399261 2 API calls 34791->34798 34799 73995e0 4 API calls 34791->34799 34800 73994d4 2 API calls 34791->34800 34801 73996f7 2 API calls 34791->34801 34802 7399487 2 API calls 34791->34802 34803 73992d6 2 API calls 34791->34803 34792->34773 34793->34792 34794->34792 34795->34792 34796->34792 34797->34792 34798->34792 34799->34792 34800->34792 34801->34792 34802->34792 34803->34792 34805 739926b 34804->34805 34866 7397580 34805->34866 34870 7397574 34805->34870 34810 7399639 34809->34810 34875 739a47f 34810->34875 34880 739a490 34810->34880 34811 7399663 34811->34778 34893 73972f8 34814->34893 34897 73972f0 34814->34897 34815 7399c53 34901 7396d28 34818->34901 34905 7396d21 34818->34905 34819 7399400 34820 7399663 34819->34820 34821 739a47f 2 API calls 34819->34821 34822 739a490 2 API calls 34819->34822 34820->34778 34821->34820 34822->34820 34826 73993ef 34825->34826 34828 739a47f 2 API calls 34826->34828 34829 739a490 2 API calls 34826->34829 34827 7399663 34827->34778 34828->34827 34829->34827 34832 7399332 34830->34832 34831 7399581 34833 7399344 34831->34833 34917 7399e30 34831->34917 34922 7399e20 34831->34922 34832->34831 34832->34833 34838 73972f8 WriteProcessMemory 34832->34838 34839 73972f0 WriteProcessMemory 34832->34839 34909 7397230 34832->34909 34913 7397238 34832->34913 34833->34778 34838->34832 34839->34832 34841 73992dc 34840->34841 34842 739930d 34841->34842 34843 7397580 CreateProcessA 34841->34843 34844 7397574 CreateProcessA 34841->34844 34842->34778 34843->34842 34844->34842 34847 73972f8 WriteProcessMemory 34845->34847 34848 73972f0 WriteProcessMemory 34845->34848 34846 73994b5 34846->34778 34847->34846 34848->34846 34927 73973e8 34849->34927 34931 73973e0 34849->34931 34850 7399719 34850->34778 34854 73994e1 34853->34854 34856 739a47f 2 API calls 34854->34856 34857 739a490 2 API calls 34854->34857 34855 7399663 34855->34778 34856->34855 34857->34855 34859 7399517 34858->34859 34860 7399400 34858->34860 34862 7396d28 Wow64SetThreadContext 34859->34862 34863 7396d21 Wow64SetThreadContext 34859->34863 34861 7399663 34860->34861 34864 739a47f 2 API calls 34860->34864 34865 739a490 2 API calls 34860->34865 34861->34778 34862->34860 34863->34860 34864->34861 34865->34861 34867 7397609 CreateProcessA 34866->34867 34869 73977cb 34867->34869 34869->34869 34871 7397504 34870->34871 34872 739757e CreateProcessA 34870->34872 34871->34778 34874 73977cb 34872->34874 34874->34874 34876 739a4b8 34875->34876 34877 739a483 34875->34877 34876->34811 34885 7396c78 34877->34885 34889 7396c70 34877->34889 34881 739a4a5 34880->34881 34883 7396c78 ResumeThread 34881->34883 34884 7396c70 ResumeThread 34881->34884 34882 739a4b8 34882->34811 34883->34882 34884->34882 34886 7396cb8 ResumeThread 34885->34886 34888 7396ce9 34886->34888 34888->34876 34890 7396cb8 ResumeThread 34889->34890 34892 7396ce9 34890->34892 34892->34876 34894 7397340 WriteProcessMemory 34893->34894 34896 7397397 34894->34896 34896->34815 34898 7397340 WriteProcessMemory 34897->34898 34900 7397397 34898->34900 34900->34815 34902 7396d6d Wow64SetThreadContext 34901->34902 34904 7396db5 34902->34904 34904->34819 34906 7396d6d Wow64SetThreadContext 34905->34906 34908 7396db5 34906->34908 34908->34819 34910 7397278 VirtualAllocEx 34909->34910 34912 73972b5 34910->34912 34912->34832 34914 7397278 VirtualAllocEx 34913->34914 34916 73972b5 34914->34916 34916->34832 34918 7399e45 34917->34918 34920 7396d28 Wow64SetThreadContext 34918->34920 34921 7396d21 Wow64SetThreadContext 34918->34921 34919 7399e5b 34919->34833 34920->34919 34921->34919 34923 7399e45 34922->34923 34925 7396d28 Wow64SetThreadContext 34923->34925 34926 7396d21 Wow64SetThreadContext 34923->34926 34924 7399e5b 34924->34833 34925->34924 34926->34924 34928 7397433 ReadProcessMemory 34927->34928 34930 7397477 34928->34930 34930->34850 34932 7397433 ReadProcessMemory 34931->34932 34934 7397477 34932->34934 34934->34850

              Executed Functions

              Function 0132D371 Relevance: 6.1, APIs: 4, Instructions: 149threadCOMMON
              Download Yara Rule

              Control-flow Graph

              APIs
              • GetCurrentProcess.KERNEL32 ref: 0132D3FE
              • GetCurrentThread.KERNEL32 ref: 0132D43B
              • GetCurrentProcess.KERNEL32 ref: 0132D478
              • GetCurrentThreadId.KERNEL32 ref: 0132D4D1
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: Current$ProcessThread
              • String ID:
              • API String ID: 2063062207-0
              • Opcode ID: b9f79e33df1305e69c58f93197c7f7e26f5bd8400207bbfd9adaf517cbc8bf10
              • Instruction ID: 167debe9b1d84858042c60092beff31e9a416a035cde1a416f29a7f8e2dac3d3
              • Opcode Fuzzy Hash: b9f79e33df1305e69c58f93197c7f7e26f5bd8400207bbfd9adaf517cbc8bf10
              • Instruction Fuzzy Hash: 196146B090030ACFDB58DFA9D948BDEBBF1FF88318F208459E509A7250DB796944CB61
              Function 0132D380 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
              Download Yara Rule

              Control-flow Graph

              APIs
              • GetCurrentProcess.KERNEL32 ref: 0132D3FE
              • GetCurrentThread.KERNEL32 ref: 0132D43B
              • GetCurrentProcess.KERNEL32 ref: 0132D478
              • GetCurrentThreadId.KERNEL32 ref: 0132D4D1
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: Current$ProcessThread
              • String ID:
              • API String ID: 2063062207-0
              • Opcode ID: 23a929a0fa5114e362c61c858c7d24cd45e4bd99e537d44b06312d28a9ac0092
              • Instruction ID: 7c85ecc7972c2075a66c4d0df8f90becb02f6c1e1d4f26039e5e8d654ecb76e1
              • Opcode Fuzzy Hash: 23a929a0fa5114e362c61c858c7d24cd45e4bd99e537d44b06312d28a9ac0092
              • Instruction Fuzzy Hash: 785145B090030ACFDB58DFAAC548BDEBBF1BF88318F208459E519B7250DB786944CB65
              Function 07396D21 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64threadCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1857 7396d21-7396d73 1859 7396d83-7396db3 Wow64SetThreadContext 1857->1859 1860 7396d75-7396d81 1857->1860 1862 7396dbc-7396dec 1859->1862 1863 7396db5-7396dbb 1859->1863 1860->1859 1863->1862
              APIs
              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07396DA6
              Strings
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: ContextThreadWow64
              • String ID: W
              • API String ID: 983334009-655174618
              • Opcode ID: d68ce7f21ab627957ce47f9a67753534b2ec8b1ebbd77bb05228cbf2cca13367
              • Instruction ID: a98783067b0035e6c140cf264a4c0003fc1955c020a087fda142583c5c24e64a
              • Opcode Fuzzy Hash: d68ce7f21ab627957ce47f9a67753534b2ec8b1ebbd77bb05228cbf2cca13367
              • Instruction Fuzzy Hash: 8F2139B290034ACFEB10DFA9C4857EEBBF4AF48224F14842AD559A7240DB789544CF90
              Function 07397230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56memoryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1867 7397230-73972b3 VirtualAllocEx 1870 73972bc-73972e1 1867->1870 1871 73972b5-73972bb 1867->1871 1871->1870
              APIs
              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073972A6
              Strings
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: AllocVirtual
              • String ID: W
              • API String ID: 4275171209-655174618
              • Opcode ID: 67ab9b3120700a5ed018787acc8076937f671d1d2e14b97b31476b35638b0283
              • Instruction ID: 21211040b5672d69760078f4bf49b2d39b451400e7e2b36082574ce6cbe1e66c
              • Opcode Fuzzy Hash: 67ab9b3120700a5ed018787acc8076937f671d1d2e14b97b31476b35638b0283
              • Instruction Fuzzy Hash: 231167B680024A9FEF10CFA9C8447EEBBF1EF48320F10881AE559A7240C7799550CBA0
              Function 07396C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52threadCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1875 7396c70-7396ce7 ResumeThread 1878 7396ce9-7396cef 1875->1878 1879 7396cf0-7396d15 1875->1879 1878->1879
              APIs
              Strings
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: ResumeThread
              • String ID: W
              • API String ID: 947044025-655174618
              • Opcode ID: fd5cb4c6ff1371a51c2c1c8432a78946564ea5666f526c4a9e7be87faa4dd60c
              • Instruction ID: 42d9204823d5f4fdb5130c6746c2c4defc86680396cca02610a237d12d465c18
              • Opcode Fuzzy Hash: fd5cb4c6ff1371a51c2c1c8432a78946564ea5666f526c4a9e7be87faa4dd60c
              • Instruction Fuzzy Hash: 501176B190024ACFEB20CFAAC4457EEFBF4AF88220F24842AD559A7640CB786544CF94
              Function 07397574 Relevance: 1.8, APIs: 1, Instructions: 280processCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1883 7397574-739757c 1884 739757e-7397615 1883->1884 1885 7397504-739753a 1883->1885 1888 739764e-739766e 1884->1888 1889 7397617-7397621 1884->1889 1902 739753c-7397542 1885->1902 1903 7397543-7397568 1885->1903 1895 7397670-739767a 1888->1895 1896 73976a7-73976d6 1888->1896 1889->1888 1890 7397623-7397625 1889->1890 1893 7397648-739764b 1890->1893 1894 7397627-7397631 1890->1894 1893->1888 1897 7397633 1894->1897 1898 7397635-7397644 1894->1898 1895->1896 1901 739767c-739767e 1895->1901 1911 73976d8-73976e2 1896->1911 1912 739770f-73977c9 CreateProcessA 1896->1912 1897->1898 1898->1898 1900 7397646 1898->1900 1900->1893 1904 73976a1-73976a4 1901->1904 1905 7397680-739768a 1901->1905 1902->1903 1904->1896 1909 739768c 1905->1909 1910 739768e-739769d 1905->1910 1909->1910 1910->1910 1914 739769f 1910->1914 1911->1912 1913 73976e4-73976e6 1911->1913 1924 73977cb-73977d1 1912->1924 1925 73977d2-7397858 1912->1925 1915 7397709-739770c 1913->1915 1916 73976e8-73976f2 1913->1916 1914->1904 1915->1912 1919 73976f4 1916->1919 1920 73976f6-7397705 1916->1920 1919->1920 1920->1920 1921 7397707 1920->1921 1921->1915 1924->1925 1935 7397868-739786c 1925->1935 1936 739785a-739785e 1925->1936 1938 739787c-7397880 1935->1938 1939 739786e-7397872 1935->1939 1936->1935 1937 7397860 1936->1937 1937->1935 1941 7397890-7397894 1938->1941 1942 7397882-7397886 1938->1942 1939->1938 1940 7397874 1939->1940 1940->1938 1944 73978a6-73978ad 1941->1944 1945 7397896-739789c 1941->1945 1942->1941 1943 7397888 1942->1943 1943->1941 1946 73978af-73978be 1944->1946 1947 73978c4 1944->1947 1945->1944 1946->1947 1949 73978c5 1947->1949 1949->1949
              APIs
              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073977B6
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: CreateProcess
              • String ID:
              • API String ID: 963392458-0
              • Opcode ID: c6cb1b8ff1e8f9d9c5212ca3864d756e08d2c1f2149751b5ba40337c4735c328
              • Instruction ID: 1e5865704d74c0a6ea753799d574567197aef6ed17c0759b889aec77d81f2ec2
              • Opcode Fuzzy Hash: c6cb1b8ff1e8f9d9c5212ca3864d756e08d2c1f2149751b5ba40337c4735c328
              • Instruction Fuzzy Hash: DAB17EB1D1061ADFEF10CF69C845BEEBBB2BF48310F1485A9D809A7280DB759985CF91
              Function 07397580 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 1950 7397580-7397615 1952 739764e-739766e 1950->1952 1953 7397617-7397621 1950->1953 1958 7397670-739767a 1952->1958 1959 73976a7-73976d6 1952->1959 1953->1952 1954 7397623-7397625 1953->1954 1956 7397648-739764b 1954->1956 1957 7397627-7397631 1954->1957 1956->1952 1960 7397633 1957->1960 1961 7397635-7397644 1957->1961 1958->1959 1963 739767c-739767e 1958->1963 1969 73976d8-73976e2 1959->1969 1970 739770f-73977c9 CreateProcessA 1959->1970 1960->1961 1961->1961 1962 7397646 1961->1962 1962->1956 1964 73976a1-73976a4 1963->1964 1965 7397680-739768a 1963->1965 1964->1959 1967 739768c 1965->1967 1968 739768e-739769d 1965->1968 1967->1968 1968->1968 1972 739769f 1968->1972 1969->1970 1971 73976e4-73976e6 1969->1971 1981 73977cb-73977d1 1970->1981 1982 73977d2-7397858 1970->1982 1973 7397709-739770c 1971->1973 1974 73976e8-73976f2 1971->1974 1972->1964 1973->1970 1976 73976f4 1974->1976 1977 73976f6-7397705 1974->1977 1976->1977 1977->1977 1978 7397707 1977->1978 1978->1973 1981->1982 1992 7397868-739786c 1982->1992 1993 739785a-739785e 1982->1993 1995 739787c-7397880 1992->1995 1996 739786e-7397872 1992->1996 1993->1992 1994 7397860 1993->1994 1994->1992 1998 7397890-7397894 1995->1998 1999 7397882-7397886 1995->1999 1996->1995 1997 7397874 1996->1997 1997->1995 2001 73978a6-73978ad 1998->2001 2002 7397896-739789c 1998->2002 1999->1998 2000 7397888 1999->2000 2000->1998 2003 73978af-73978be 2001->2003 2004 73978c4 2001->2004 2002->2001 2003->2004 2006 73978c5 2004->2006 2006->2006
              APIs
              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073977B6
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: CreateProcess
              • String ID:
              • API String ID: 963392458-0
              • Opcode ID: ca63b8fd56afe27a5029af0bdc8e601310aa9c3e29bbdec5c5a38b7c66a579fe
              • Instruction ID: ca54e1befec47464d5298fdb69c67afb8e62b3b2fddbd7851525101d47745340
              • Opcode Fuzzy Hash: ca63b8fd56afe27a5029af0bdc8e601310aa9c3e29bbdec5c5a38b7c66a579fe
              • Instruction Fuzzy Hash: E3915DB1D1061ADFEF14DF68C841BEEBBB2BF48314F1481A9D808A7280DB749985CF91
              Function 0132B0E8 Relevance: 1.7, APIs: 1, Instructions: 198COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 2007 132b0e8-132b0f7 2008 132b123-132b127 2007->2008 2009 132b0f9-132b106 call 132ada0 2007->2009 2011 132b13b-132b17c 2008->2011 2012 132b129-132b133 2008->2012 2016 132b108 2009->2016 2017 132b11c 2009->2017 2018 132b189-132b197 2011->2018 2019 132b17e-132b186 2011->2019 2012->2011 2062 132b10e call 132b370 2016->2062 2063 132b10e call 132b380 2016->2063 2017->2008 2020 132b1bb-132b1bd 2018->2020 2021 132b199-132b19e 2018->2021 2019->2018 2026 132b1c0-132b1c7 2020->2026 2023 132b1a0-132b1a7 call 132adac 2021->2023 2024 132b1a9 2021->2024 2022 132b114-132b116 2022->2017 2025 132b258-132b318 2022->2025 2030 132b1ab-132b1b9 2023->2030 2024->2030 2057 132b320-132b34b GetModuleHandleW 2025->2057 2058 132b31a-132b31d 2025->2058 2027 132b1d4-132b1db 2026->2027 2028 132b1c9-132b1d1 2026->2028 2031 132b1e8-132b1f1 call 132adbc 2027->2031 2032 132b1dd-132b1e5 2027->2032 2028->2027 2030->2026 2038 132b1f3-132b1fb 2031->2038 2039 132b1fe-132b203 2031->2039 2032->2031 2038->2039 2040 132b221-132b225 2039->2040 2041 132b205-132b20c 2039->2041 2064 132b228 call 132b680 2040->2064 2065 132b228 call 132b651 2040->2065 2041->2040 2043 132b20e-132b21e call 132adcc call 132addc 2041->2043 2043->2040 2044 132b22b-132b22e 2047 132b230-132b24e 2044->2047 2048 132b251-132b257 2044->2048 2047->2048 2059 132b354-132b368 2057->2059 2060 132b34d-132b353 2057->2060 2058->2057 2060->2059 2062->2022 2063->2022 2064->2044 2065->2044
              APIs
              • GetModuleHandleW.KERNELBASE(00000000), ref: 0132B33E
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: HandleModule
              • String ID:
              • API String ID: 4139908857-0
              • Opcode ID: 54e0d9109908dd5a63a06c1d4f41a68149a68096d066f8581e1a4447c8e55d0a
              • Instruction ID: 34d5023e433582ec1dddf2dcb7e728c8f97a2fa2cbbccba239744b23d3025327
              • Opcode Fuzzy Hash: 54e0d9109908dd5a63a06c1d4f41a68149a68096d066f8581e1a4447c8e55d0a
              • Instruction Fuzzy Hash: A0714570A00B168FD724EF6AD45475ABBF1FF88208F108A2DD58AD7A44DB74E845CB91
              Function 02D01C91 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 2066 2d01c91-2d01ca4 2067 2d01ca6-2d01cd0 call 2d01130 2066->2067 2068 2d01cde-2d01d56 2066->2068 2072 2d01cd5-2d01cd6 2067->2072 2070 2d01d61-2d01d68 2068->2070 2071 2d01d58-2d01d5e 2068->2071 2073 2d01d73-2d01e12 CreateWindowExW 2070->2073 2074 2d01d6a-2d01d70 2070->2074 2071->2070 2076 2d01e14-2d01e1a 2073->2076 2077 2d01e1b-2d01e53 2073->2077 2074->2073 2076->2077 2081 2d01e60 2077->2081 2082 2d01e55-2d01e58 2077->2082 2083 2d01e61 2081->2083 2082->2081 2083->2083
              APIs
              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02D01E02
              Memory Dump Source
              • Source File: 0000000E.00000002.2177528037.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_2d00000_VajtonZVfAG.jbxd
              Similarity
              • API ID: CreateWindow
              • String ID:
              • API String ID: 716092398-0
              • Opcode ID: b7e8c6636090b3a3d00aedff4f9a462363c11e420f35f631c2b0ca91b4dfc37d
              • Instruction ID: 7d68dff03904192725b1f10f5458b1ad20c48bb59d1dd8e80c1a57cbddbfec60
              • Opcode Fuzzy Hash: b7e8c6636090b3a3d00aedff4f9a462363c11e420f35f631c2b0ca91b4dfc37d
              • Instruction Fuzzy Hash: A751DDB1C00249AFDF15CFA9C980ADEBFB6BF48314F25816AE908AB260D7759855CF50
              Function 02D01CF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 2084 2d01cf0-2d01d56 2085 2d01d61-2d01d68 2084->2085 2086 2d01d58-2d01d5e 2084->2086 2087 2d01d73-2d01dab 2085->2087 2088 2d01d6a-2d01d70 2085->2088 2086->2085 2089 2d01db3-2d01e12 CreateWindowExW 2087->2089 2088->2087 2090 2d01e14-2d01e1a 2089->2090 2091 2d01e1b-2d01e53 2089->2091 2090->2091 2095 2d01e60 2091->2095 2096 2d01e55-2d01e58 2091->2096 2097 2d01e61 2095->2097 2096->2095 2097->2097
              APIs
              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02D01E02
              Memory Dump Source
              • Source File: 0000000E.00000002.2177528037.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_2d00000_VajtonZVfAG.jbxd
              Similarity
              • API ID: CreateWindow
              • String ID:
              • API String ID: 716092398-0
              • Opcode ID: a6439c05ac649a6438615422c30a5dd686de1f23a3b706c76f743e616dc278e6
              • Instruction ID: 4662e10ade156da276ecf6ebdf93a7b4317d2dce1664252d05e6bf0eb66a7950
              • Opcode Fuzzy Hash: a6439c05ac649a6438615422c30a5dd686de1f23a3b706c76f743e616dc278e6
              • Instruction Fuzzy Hash: 9241AFB1D00359DFDB14CF99C984ADEBBB5FF48310F24812AE819AB250D7B5A885CF90
              Function 0132590C Relevance: 1.6, APIs: 1, Instructions: 100COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 2098 132590c-13259d9 CreateActCtxA 2100 13259e2-1325a3c 2098->2100 2101 13259db-13259e1 2098->2101 2108 1325a4b-1325a4f 2100->2108 2109 1325a3e-1325a41 2100->2109 2101->2100 2110 1325a60 2108->2110 2111 1325a51-1325a5d 2108->2111 2109->2108 2113 1325a61 2110->2113 2111->2110 2113->2113
              APIs
              • CreateActCtxA.KERNEL32(?), ref: 013259C9
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: Create
              • String ID:
              • API String ID: 2289755597-0
              • Opcode ID: d5e609612144d63ce3a539f3739849340796d99c9d333de1565dac1e955bfb3d
              • Instruction ID: 8bbec317198b41348f616b7b67747d070b0cf601f25f0debab8661b618a1aadb
              • Opcode Fuzzy Hash: d5e609612144d63ce3a539f3739849340796d99c9d333de1565dac1e955bfb3d
              • Instruction Fuzzy Hash: DA41EFB0C00719CFEB24DFA9C885ADEBBF5BF49314F20816AD408AB251DB756949CF50
              Function 02D01284 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 2114 2d01284-2d042fc 2117 2d04302-2d04307 2114->2117 2118 2d043ac-2d043cc call 2d0115c 2114->2118 2119 2d04309-2d04340 2117->2119 2120 2d0435a-2d04392 CallWindowProcW 2117->2120 2125 2d043cf-2d043dc 2118->2125 2128 2d04342-2d04348 2119->2128 2129 2d04349-2d04358 2119->2129 2122 2d04394-2d0439a 2120->2122 2123 2d0439b-2d043aa 2120->2123 2122->2123 2123->2125 2128->2129 2129->2125
              APIs
              • CallWindowProcW.USER32(?,?,?,?,?), ref: 02D04381
              Memory Dump Source
              • Source File: 0000000E.00000002.2177528037.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_2d00000_VajtonZVfAG.jbxd
              Similarity
              • API ID: CallProcWindow
              • String ID:
              • API String ID: 2714655100-0
              • Opcode ID: 1d36f1daa82908e4b3a5c86a83efc442cf50fdbbb0e3edb713e0a6370041ac48
              • Instruction ID: 6921bdcef6a5ec64ab5038ce5caf29e77f962be00be7b7d266e3af19f44996e2
              • Opcode Fuzzy Hash: 1d36f1daa82908e4b3a5c86a83efc442cf50fdbbb0e3edb713e0a6370041ac48
              • Instruction Fuzzy Hash: 854135B4A00309CFDB14CF99C488BAABBF5FF88314F248459D559AB360D774A841CBA0
              Function 01324514 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 2131 1324514-13259d9 CreateActCtxA 2134 13259e2-1325a3c 2131->2134 2135 13259db-13259e1 2131->2135 2142 1325a4b-1325a4f 2134->2142 2143 1325a3e-1325a41 2134->2143 2135->2134 2144 1325a60 2142->2144 2145 1325a51-1325a5d 2142->2145 2143->2142 2147 1325a61 2144->2147 2145->2144 2147->2147
              APIs
              • CreateActCtxA.KERNEL32(?), ref: 013259C9
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: Create
              • String ID:
              • API String ID: 2289755597-0
              • Opcode ID: c26410299ef5cc99148589d72b3184e05181d2d0192c506ca92433269aef84a1
              • Instruction ID: d34d1b098e81aa201d1724681af86ff41955896ac9aada54ea780b12a942aad0
              • Opcode Fuzzy Hash: c26410299ef5cc99148589d72b3184e05181d2d0192c506ca92433269aef84a1
              • Instruction Fuzzy Hash: 7941E0B0C0072DCBEB24DFA9C884B9EBBF5BF49704F60815AD508AB251DB756945CF90
              Function 0739A822 Relevance: 1.6, APIs: 1, Instructions: 77COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6aae51521a18a34393d5454cb3a5c99b9070f866ce684f9d35a99496dd4faf86
              • Instruction ID: dcc7581f2485fdabf54bfdc7d0261ba5d4d7471fbe91ef787555c3f476d2e853
              • Opcode Fuzzy Hash: 6aae51521a18a34393d5454cb3a5c99b9070f866ce684f9d35a99496dd4faf86
              • Instruction Fuzzy Hash: BA2106F2D082259BEF11DB69D4047EEFFF4AF84320F108269C805B7281D7358D02CAA0
              Function 073972F0 Relevance: 1.6, APIs: 1, Instructions: 73injectionCOMMON
              Download Yara Rule
              APIs
              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07397388
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: MemoryProcessWrite
              • String ID:
              • API String ID: 3559483778-0
              • Opcode ID: 95d53aa160866e7f9eebeeabd0553a1680ecc90c19ecb133acae8c2043556bdf
              • Instruction ID: 2547100a712145c46491daa223a343e87eba93c6d5a4ff6a82dc8f4c69d8fa0b
              • Opcode Fuzzy Hash: 95d53aa160866e7f9eebeeabd0553a1680ecc90c19ecb133acae8c2043556bdf
              • Instruction Fuzzy Hash: CE2112B290034A9FDF10CFA9C985BDEBBB1EF48210F14842AE918A7240D7799954CBA0
              Function 073972F8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
              Download Yara Rule
              APIs
              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07397388
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: MemoryProcessWrite
              • String ID:
              • API String ID: 3559483778-0
              • Opcode ID: 4a8c9457fa93d3178cad6442a24c4803e55e3a26b6163783bacca392f63665fe
              • Instruction ID: 41aa6f64b6f7a053ae7eceff7c9a5ecf488ad1d8d708391bcd34f1ebfc317b99
              • Opcode Fuzzy Hash: 4a8c9457fa93d3178cad6442a24c4803e55e3a26b6163783bacca392f63665fe
              • Instruction Fuzzy Hash: 9B2104B59003499FDF10CFA9C885BDEBBF5FF48310F148429E919A7240D7799954CBA4
              Function 0132D5C1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
              Download Yara Rule
              APIs
              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0132D64F
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DuplicateHandle
              • String ID:
              • API String ID: 3793708945-0
              • Opcode ID: eecefc49306c8aedccbdbcb0f908a404c2d0f0fb227cbf3a2faede205c93d8ea
              • Instruction ID: 4ee8f797d548df095bb4e6314562d7f04b71a651103d182c8b14d65cea116724
              • Opcode Fuzzy Hash: eecefc49306c8aedccbdbcb0f908a404c2d0f0fb227cbf3a2faede205c93d8ea
              • Instruction Fuzzy Hash: 9421E4B5900249AFDB10CFAAD585AEEFFF4FB48324F14841AE918A3350D379A955CF60
              Function 07396D28 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
              Download Yara Rule
              APIs
              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07396DA6
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: ContextThreadWow64
              • String ID:
              • API String ID: 983334009-0
              • Opcode ID: bc374cd1a6e93610193a5b89980319fe5f6ac1947efcd14f48a55e39425464c8
              • Instruction ID: e3450c23ad9964c1e3045e42a4df64eca8a0875aa700e3a27055449d9e5d0bd3
              • Opcode Fuzzy Hash: bc374cd1a6e93610193a5b89980319fe5f6ac1947efcd14f48a55e39425464c8
              • Instruction Fuzzy Hash: 8F211AB19003099FEB10DFAAC4857EEBBF4EF88314F148429D559A7240D7789954CFA5
              Function 073973E8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
              Download Yara Rule
              APIs
              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07397468
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: MemoryProcessRead
              • String ID:
              • API String ID: 1726664587-0
              • Opcode ID: 14fc7848c8c963ad60986448df79c97807dfdb63584e722d13d470cb7fdc859a
              • Instruction ID: 0285247f81f1eafc423c047f3398fa322640ec508ba37bab4b175550229e4055
              • Opcode Fuzzy Hash: 14fc7848c8c963ad60986448df79c97807dfdb63584e722d13d470cb7fdc859a
              • Instruction Fuzzy Hash: 2A2116B18003599FDF10DFAAC881ADEBBF5FF48310F108429E519A7240D7789554CBA4
              Function 073973E0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
              Download Yara Rule
              APIs
              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07397468
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: MemoryProcessRead
              • String ID:
              • API String ID: 1726664587-0
              • Opcode ID: 8fe307ac7284865dfa9d94ce7aa11ec6c55487fb28fc69b2f2576b4f874b7b01
              • Instruction ID: 4732c99733b8101235496ce3a3634dd2f49b68518a080254340c9d242bcbe701
              • Opcode Fuzzy Hash: 8fe307ac7284865dfa9d94ce7aa11ec6c55487fb28fc69b2f2576b4f874b7b01
              • Instruction Fuzzy Hash: 062105B190035A9FEF10DFA9C985AEEBBF5FF48310F10842AE919A7240D7789954CB64
              Function 0132D5C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
              Download Yara Rule
              APIs
              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0132D64F
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DuplicateHandle
              • String ID:
              • API String ID: 3793708945-0
              • Opcode ID: 3164fd9670c3e0bdd5272467e54ec823bf035aa982b223b29945b80987c15962
              • Instruction ID: fc1bde7dacd915cbd637e66df7616c3d54f4c4fe6a629c47e99661ff4398d978
              • Opcode Fuzzy Hash: 3164fd9670c3e0bdd5272467e54ec823bf035aa982b223b29945b80987c15962
              • Instruction Fuzzy Hash: 4E21C4B59002599FDB10CF9AD984ADEFFF8FB48324F14841AE918A3350D378A954CFA5
              Function 0739A788 Relevance: 1.6, APIs: 1, Instructions: 54windowCOMMON
              Download Yara Rule
              APIs
              • PostMessageW.USER32(?,00000010,00000000,?), ref: 0739A7ED
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: MessagePost
              • String ID:
              • API String ID: 410705778-0
              • Opcode ID: 717698f3b357c241de3329c3b8c3565224405d52c4a786fe9f508752f31dc3b0
              • Instruction ID: b8801c6f922473511aa8414b8ddcb719aac64b0934c575417c7f9a5d61e75527
              • Opcode Fuzzy Hash: 717698f3b357c241de3329c3b8c3565224405d52c4a786fe9f508752f31dc3b0
              • Instruction Fuzzy Hash: 6A1144B690024ADFEB10DF99D485BDEBBF4EB08314F24845AD459A7602D374A984CFA0
              Function 07397238 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
              Download Yara Rule
              APIs
              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073972A6
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: AllocVirtual
              • String ID:
              • API String ID: 4275171209-0
              • Opcode ID: 5f16aa4fd39334478116747b34a90d473de1885f7e9663b216a7fb20adda73fd
              • Instruction ID: 293cbfc4ac7f277c3c902acad8973c2731a50ab507ebdfd8e312a201118c9787
              • Opcode Fuzzy Hash: 5f16aa4fd39334478116747b34a90d473de1885f7e9663b216a7fb20adda73fd
              • Instruction Fuzzy Hash: 891126B680024A9FEF10DFAAC845BDEBBF5EF88320F148419E519A7250C775A950CBA4
              Function 07396C78 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
              Download Yara Rule
              APIs
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: ResumeThread
              • String ID:
              • API String ID: 947044025-0
              • Opcode ID: 3eb288ef45f4acb9768543f0152bdb68744e53a852585f54365d619b74ca45bb
              • Instruction ID: e6ba4f23887093b59971c3cde224434a1c56ee2ada7b0cd5461142058c8f011e
              • Opcode Fuzzy Hash: 3eb288ef45f4acb9768543f0152bdb68744e53a852585f54365d619b74ca45bb
              • Instruction Fuzzy Hash: 10113AB1900349CFEB10DFAAC44579EFBF8EF88724F248429D519A7240CB796544CF94
              Function 0132B2D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
              Download Yara Rule
              APIs
              • GetModuleHandleW.KERNELBASE(00000000), ref: 0132B33E
              Memory Dump Source
              • Source File: 0000000E.00000002.2176638980.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_1320000_VajtonZVfAG.jbxd
              Similarity
              • API ID: HandleModule
              • String ID:
              • API String ID: 4139908857-0
              • Opcode ID: ca7cae830b91962d53d2d524d6f74473fc7bba5c9ca331b633592b1d4f6e3d04
              • Instruction ID: 8d5d6b68bce6b7cd431356a09955566f906fc106a9486537814bf7f0038e6404
              • Opcode Fuzzy Hash: ca7cae830b91962d53d2d524d6f74473fc7bba5c9ca331b633592b1d4f6e3d04
              • Instruction Fuzzy Hash: 42110FB6C006498FDB10DF9AC444A9EFBF4EB88224F14841AD919B7200D379A545CFA1
              Function 07399FDC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
              Download Yara Rule
              APIs
              • PostMessageW.USER32(?,00000010,00000000,?), ref: 0739A7ED
              Memory Dump Source
              • Source File: 0000000E.00000002.2206604251.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_7390000_VajtonZVfAG.jbxd
              Similarity
              • API ID: MessagePost
              • String ID:
              • API String ID: 410705778-0
              • Opcode ID: 886b31ac012bba23c7607b2ff8a3c536cd93524b1aaae7d0139cb9e5588b8528
              • Instruction ID: f03d9c6570b61d7c963cc426984c506979b4b08e178d9258a47ff38959491318
              • Opcode Fuzzy Hash: 886b31ac012bba23c7607b2ff8a3c536cd93524b1aaae7d0139cb9e5588b8528
              • Instruction Fuzzy Hash: DF11E3B58047499FDB50DF99C485BDEBBF8EB48320F20841AE518A7600D375A954CFA1
              Function 00FDD4C4 Relevance: .1, Instructions: 75COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175536572.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_fdd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e656476c70623e997a5e9c5323751adbcb3828db9b6801b40604bbfc52f3cf6d
              • Instruction ID: e97187fe4f12853407f391fbe6d6682c22ed91d312ec65e2993ae0ae15af5824
              • Opcode Fuzzy Hash: e656476c70623e997a5e9c5323751adbcb3828db9b6801b40604bbfc52f3cf6d
              • Instruction Fuzzy Hash: 69212872504244EFDB15DF14E9C0F26BF66FB84328F28C56AD9090B356C336D856DBA1
              Function 00FFD01C Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175626150.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_ffd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: c4784733e33f06974996690903ae90ecb0282ab02f5a15d55b8c5d0e3f8ca1de
              • Instruction ID: d379f6ceb7f44845090dac4bd2d0c84be6b5169e4220b0bf07903ecb690a8672
              • Opcode Fuzzy Hash: c4784733e33f06974996690903ae90ecb0282ab02f5a15d55b8c5d0e3f8ca1de
              • Instruction Fuzzy Hash: 4A212576504208EFDB14DF14D5C0B26BB62FF84324F20C56DDA0A4B26ACB76D807DA61
              Function 00FFD1D4 Relevance: .1, Instructions: 72COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175626150.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_ffd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 4193c36752fae652b25a685ed31a4e7e8ecd75b3d15535e6cfbcc385d8158ee5
              • Instruction ID: f7ed19745d603e8f0ef576b37b52b4678846665713df2de232897561d70b788d
              • Opcode Fuzzy Hash: 4193c36752fae652b25a685ed31a4e7e8ecd75b3d15535e6cfbcc385d8158ee5
              • Instruction Fuzzy Hash: 95212976904308EFDB05DF14D9C0B36BB66FF84324F20C5ADDA094B262C776D846DAA1
              Function 00FFD005 Relevance: .1, Instructions: 62COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175626150.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_ffd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 91f71b091b192c72bb401e37077d6b11b00eea2d4caf8bb3575416e563b661cc
              • Instruction ID: 35d06fc215f816984635c0661fd6e34e0baf15eb135a0322a70337d70cc1effc
              • Opcode Fuzzy Hash: 91f71b091b192c72bb401e37077d6b11b00eea2d4caf8bb3575416e563b661cc
              • Instruction Fuzzy Hash: 532180755093C48FCB02CF20D990715BF72EF46314F28C5EAD9498B2A7C33A980ACB62
              Function 00FDD4BF Relevance: .1, Instructions: 56COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175536572.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_fdd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
              • Instruction ID: 01576c830db2c5970152c9c0cdaaf91a4673c699c9aef3d99f94607440d56e26
              • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
              • Instruction Fuzzy Hash: BD11E676904280DFCB15CF10D5C4B16BF72FB94328F28C6AAD8490B756C33AD856DBA1
              Function 00FFD1CF Relevance: .1, Instructions: 53COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175626150.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_ffd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
              • Instruction ID: e92495fe852e9d586a606bdc723659a7cd0cf5c0d27d761eb8d577a7d317b238
              • Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
              • Instruction Fuzzy Hash: 05118E75904284DFCB15CF10D5C4B25BB62FF84324F24C6AAD9494B666C33AD84ADB91
              Function 00FDD745 Relevance: .0, Instructions: 45COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175536572.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_fdd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: e4751af267cba366a386015d0f862fb6bd11bc82e57cf007fa2ac118ae0243c0
              • Instruction ID: 5b770bd97eb290eb3a597ca15da46e7ebc552092950c4342499abd4f53d7847f
              • Opcode Fuzzy Hash: e4751af267cba366a386015d0f862fb6bd11bc82e57cf007fa2ac118ae0243c0
              • Instruction Fuzzy Hash: 1801F272808340AAE7204E25CD84B26BF98DF41334F1CC5ABEE090A382D6B99840DAB1
              Function 00FDD744 Relevance: .0, Instructions: 36COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 0000000E.00000002.2175536572.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_14_2_fdd000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 7fa622ae3ecf70adf6c07f7e313b9d245f369e6d77d03c9da560d396131abae7
              • Instruction ID: a4291508f9ad719bdbd55facc9d91384da43ef07799cfe6eda45468934adbe25
              • Opcode Fuzzy Hash: 7fa622ae3ecf70adf6c07f7e313b9d245f369e6d77d03c9da560d396131abae7
              • Instruction Fuzzy Hash: FDF06272805344AAE7148E15D9C4B62FF98EB91734F18C45BED0C5A286C379A844CBB1

              Execution Graph

              Execution Coverage:0%
              Dynamic/Decrypted Code Coverage:100%
              Signature Coverage:0%
              Total number of Nodes:5
              Total number of Limit Nodes:1
              execution_graph 62916 17f2c70 LdrInitializeThunk 62918 17f2c00 62920 17f2c0a 62918->62920 62921 17f2c1f LdrInitializeThunk 62920->62921 62922 17f2c11 62920->62922

              Executed Functions

              Function 017F2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 0 17f2c0a-17f2c0f 1 17f2c1f-17f2c26 LdrInitializeThunk 0->1 2 17f2c11-17f2c18 0->2
              APIs
              • LdrInitializeThunk.NTDLL(0180FD4F,000000FF,00000024,018A6634,00000004,00000000,?,-00000018,7D810F61,?,?,017C8B12,?,?,?,?), ref: 017F2C24
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: bf9341db8686d92d3190550deda9752700a505a7d4c9843f1b856b5a91ab81f4
              • Instruction ID: 6fc36a2bfa57b6d0c87fb2fe631eb7fce62fe651ea548c9865e3a5ef89b8066a
              • Opcode Fuzzy Hash: bf9341db8686d92d3190550deda9752700a505a7d4c9843f1b856b5a91ab81f4
              • Instruction Fuzzy Hash: EEB09B71D019C5C9DB52E7644A087177900B7D1711F15C065D3034695F8738C1D5E276
              Function 017F2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 5 17f2df0-17f2dfc LdrInitializeThunk
              APIs
              • LdrInitializeThunk.NTDLL(0182E73E,0000005A,0188D040,00000020,00000000,0188D040,00000080,01814A81,00000000,-00000001,-00000001,00000002,00000000,?,-00000001,017FAE00), ref: 017F2DFA
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: d46f43e03a073fb2ee82efc7326a08d2d686db0013c2351aa62c840a252b3103
              • Instruction ID: 1dea0d6e83d09e767c2ca66a0fb2ec03541f0e37fd4a3220214cd6349363efb7
              • Opcode Fuzzy Hash: d46f43e03a073fb2ee82efc7326a08d2d686db0013c2351aa62c840a252b3103
              • Instruction Fuzzy Hash: 8290023160180857D15271584904707000997D1341F95C412A142859CDD6568BD6A222
              Function 017F2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 4 17f2c70-17f2c7c LdrInitializeThunk
              APIs
              • LdrInitializeThunk.NTDLL(017AFB34,000000FF,?,-00000018,?,00000000,00004000,00000000,?,?,01807BE5,00001000,00004000,000000FF,?,00000000), ref: 017F2C7A
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: 33f53350778bca0a8a8a2866e8d9ad3621be110301a59f8eea94bfdfc2c924a9
              • Instruction ID: 9e7c22aff079084dbe5ebcbcdf943353f62f616db7bf92e3b17a0f5d1134bcc1
              • Opcode Fuzzy Hash: 33f53350778bca0a8a8a2866e8d9ad3621be110301a59f8eea94bfdfc2c924a9
              • Instruction Fuzzy Hash: DE90023160188C46D1517158880474A000597D1301F59C411A542869CDC6958AD57222
              Function 017F35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 6 17f35c0-17f35cc LdrInitializeThunk
              APIs
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: InitializeThunk
              • String ID:
              • API String ID: 2994545307-0
              • Opcode ID: a3fa59dd017ac628186501af29686a076fbdcb0d4130c5ece3e87d5c01fc5d26
              • Instruction ID: 751d752ae877c753cd6593c60e76bd20503a963e39bb696491df726c41a16d66
              • Opcode Fuzzy Hash: a3fa59dd017ac628186501af29686a076fbdcb0d4130c5ece3e87d5c01fc5d26
              • Instruction Fuzzy Hash: EC900231A0590846D14171584914706100597D1301F65C411A14285ACDC7958BD566A3
              Function 0042DC0E Relevance: 1.3, Strings: 1, Instructions: 48COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 7 42dc0e-42dc2a 9 42dc39-42dc40 7->9 10 42dc4f-42dc54 9->10 11 42dc56-42dc5f 10->11 12 42dcae-42dcb3 10->12 13 42dc6e-42dc73 11->13 14 42dc86-42dca5 13->14 15 42dc75-42dc83 13->15 18 42dcab 14->18 15->14 18->12
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2234515868.000000000042D000.00000040.00000400.00020000.00000000.sdmp, Offset: 0042D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_42d000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID: $
              • API String ID: 0-3993045852
              • Opcode ID: 6f15970e0fb464529db4e42ea54c55f6a45ecea257cd5b11fbe1991311a78b1f
              • Instruction ID: d92147603f1d514448f639c6f4d3a778bc42d12a9635da665598815ceb56a42a
              • Opcode Fuzzy Hash: 6f15970e0fb464529db4e42ea54c55f6a45ecea257cd5b11fbe1991311a78b1f
              • Instruction Fuzzy Hash: 390156B1D1022C56EB10FB659D82FDDB7B89B04304F4087DABA0CB6181EBB46759CBA5
              Function 0042DC13 Relevance: 1.3, Strings: 1, Instructions: 44COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 19 42dc13-42dc54 22 42dc56-42dc73 19->22 23 42dcae-42dcb3 19->23 25 42dc86-42dca5 22->25 26 42dc75-42dc83 22->26 29 42dcab 25->29 26->25 29->23
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2234515868.000000000042D000.00000040.00000400.00020000.00000000.sdmp, Offset: 0042D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_42d000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID: $
              • API String ID: 0-3993045852
              • Opcode ID: be778f5f6d1f781733b4b39b8fa7912411fb927674c4181bde295b2703031fd7
              • Instruction ID: bd5ffa0e64dd0293c211847313d0fa4516ed307802ff3bfbd1a3f2a6d3bd109c
              • Opcode Fuzzy Hash: be778f5f6d1f781733b4b39b8fa7912411fb927674c4181bde295b2703031fd7
              • Instruction Fuzzy Hash: 69017971D1022C56EB10FB659D82FDDB3B85B04304F4087DAAA0CB2181EF745759CF95
              Function 0042DCB6 Relevance: .1, Instructions: 74COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 30 42dcb6-42dcbc 31 42dc47-42dc54 30->31 32 42dcbe-42dcfa 30->32 33 42dc56-42dc73 31->33 34 42dcae-42dcb3 31->34 40 42dd31-42dd47 32->40 41 42dcfc-42dd2e 32->41 38 42dc86-42dca5 33->38 39 42dc75-42dc83 33->39 46 42dcab 38->46 39->38 41->40 46->34
              Memory Dump Source
              • Source File: 00000013.00000002.2234515868.000000000042D000.00000040.00000400.00020000.00000000.sdmp, Offset: 0042D000, based on PE: false
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_42d000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 167ce7fbdce2a66b7526af5bd398340cc3e0643771c47764615e84f8ef662128
              • Instruction ID: bd659d687ee06effd86fa0157c19e1b3bd99cba424586e56c2ce575d4b2a04ff
              • Opcode Fuzzy Hash: 167ce7fbdce2a66b7526af5bd398340cc3e0643771c47764615e84f8ef662128
              • Instruction Fuzzy Hash: 9E21D8B1D1022C5AEB60EB619C82FDDB7749B04304F4086DBE90CB6281EB785B49CFA5

              Non-executed Functions

              Function 017F4A80 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 51timeCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 47 17f4a80-17f4a8b 48 17f4a9f-17f4aa6 47->48 49 17f4a8d-17f4a99 RtlDebugPrintTimes 47->49 50 17f4aaf-17f4ab6 call 17df5a0 48->50 51 17f4aa8-17f4aae 48->51 49->48 54 17f4b25-17f4b26 49->54 56 17f4ab8-17f4b22 call 17e1e46 * 2 50->56 57 17f4b23 50->57 56->57 57->54
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: 0I8w$0I8w$0I8w$0I8w$0I8w$0I8w
              • API String ID: 3446177414-2549722193
              • Opcode ID: 8fe2fd2dec0bb53050b335e3f4d5a80c47d401e4587c984e3b314f0e8d43d98a
              • Instruction ID: 642a4c457fd3b4170088bae6e042b33bf65aa7d9a3942671c84726ff07b2fd6e
              • Opcode Fuzzy Hash: 8fe2fd2dec0bb53050b335e3f4d5a80c47d401e4587c984e3b314f0e8d43d98a
              • Instruction Fuzzy Hash: 8601D232E8C6005BF7209A2C78087873AE1B388768FC5009EEB08CF388D2244B45DB90
              Function 017F2890 Relevance: 9.2, APIs: 6, Instructions: 190COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 258 17f2890-17f28b3 259 17f28b9-17f28cc 258->259 260 182a4bc-182a4c0 258->260 262 17f28ce-17f28d7 259->262 263 17f28dd-17f28df 259->263 260->259 261 182a4c6-182a4ca 260->261 261->259 264 182a4d0-182a4d4 261->264 262->263 265 182a57e-182a585 262->265 266 17f28e1-17f28e5 263->266 264->259 269 182a4da-182a4de 264->269 265->263 267 17f28eb-17f28fa 266->267 268 17f2988-17f298e 266->268 270 182a58a-182a58d 267->270 271 17f2900-17f2905 267->271 272 17f2908-17f290c 268->272 269->259 273 182a4e4-182a4eb 269->273 270->272 271->272 272->266 274 17f290e-17f291b 272->274 275 182a564-182a56c 273->275 276 182a4ed-182a4f4 273->276 277 182a592-182a599 274->277 278 17f2921 274->278 275->259 279 182a572-182a576 275->279 280 182a4f6-182a4fe 276->280 281 182a50b 276->281 290 182a5a1-182a5c9 call 1800050 277->290 283 17f2924-17f2926 278->283 279->259 284 182a57c call 1800050 279->284 280->259 285 182a504-182a509 280->285 282 182a510-182a536 call 1800050 281->282 298 182a55d-182a55f 282->298 287 17f2928-17f292a 283->287 288 17f2993-17f2995 283->288 284->298 285->282 294 17f292c-17f292e 287->294 295 17f2946-17f2966 call 1800050 287->295 288->287 292 17f2997-17f29b1 call 1800050 288->292 307 17f2969-17f2974 292->307 294->295 301 17f2930-17f2944 call 1800050 294->301 295->307 304 17f2981-17f2985 298->304 301->295 307->283 309 17f2976-17f2979 307->309 309->290 310 17f297f 309->310 310->304
              APIs
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: ___swprintf_l
              • String ID:
              • API String ID: 48624451-0
              • Opcode ID: 12f1fb3187dde207b34df1c2011f0e4ab8fe05898b2a24b5367935f66e87e36b
              • Instruction ID: c80e5407fd37c4ea3255381c831aaac5b2857b3570c342a0ad276925b3f63576
              • Opcode Fuzzy Hash: 12f1fb3187dde207b34df1c2011f0e4ab8fe05898b2a24b5367935f66e87e36b
              • Instruction Fuzzy Hash: 6B51C3A6A00156AFCB15DBAC899097FFBB8BB48340B54826DF5A5E7642D334DE4087A0
              Function 017CA250 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 404COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 311 17ca250-17ca26f 312 17ca58d-17ca594 311->312 313 17ca275-17ca291 311->313 312->313 314 17ca59a-18179bb 312->314 315 18179e6-18179eb 313->315 316 17ca297-17ca2a0 313->316 314->313 321 18179c1-18179c6 314->321 316->315 317 17ca2a6-17ca2ac 316->317 319 17ca6ba-17ca6bc 317->319 320 17ca2b2-17ca2b4 317->320 322 17ca2ba-17ca2bd 319->322 323 17ca6c2 319->323 320->315 320->322 324 17ca473-17ca479 321->324 322->315 325 17ca2c3-17ca2c6 322->325 323->325 326 17ca2c8-17ca2d1 325->326 327 17ca2da-17ca2dd 325->327 328 18179cb-18179d5 326->328 329 17ca2d7 326->329 330 17ca6c7-17ca6d0 327->330 331 17ca2e3-17ca32b 327->331 333 18179da-18179e3 call 183f290 328->333 329->327 330->331 332 17ca6d6-18179ff 330->332 334 17ca330-17ca335 331->334 332->333 333->315 337 17ca47c-17ca47f 334->337 338 17ca33b-17ca343 334->338 339 17ca34f-17ca35d 337->339 340 17ca485-17ca488 337->340 338->339 342 17ca345-17ca349 338->342 343 17ca48e-17ca49e 339->343 346 17ca363-17ca368 339->346 340->343 344 1817a16-1817a19 340->344 342->339 345 17ca59f-17ca5a8 342->345 343->344 349 17ca4a4-17ca4ad 343->349 347 17ca36c-17ca36e 344->347 348 1817a1f-1817a24 344->348 350 17ca5aa-17ca5ac 345->350 351 17ca5c0-17ca5c3 345->351 346->347 356 1817a26 347->356 357 17ca374-17ca38c call 17ca6e0 347->357 352 1817a2b 348->352 349->347 350->339 353 17ca5b2-17ca5bb 350->353 354 1817a01 351->354 355 17ca5c9-17ca5cc 351->355 358 1817a2d-1817a2f 352->358 353->347 359 1817a0c 354->359 355->359 360 17ca5d2-17ca5d5 355->360 356->352 364 17ca4b2-17ca4b9 357->364 365 17ca392-17ca3ba 357->365 358->324 363 1817a35 358->363 359->344 360->350 366 17ca3bc-17ca3be 364->366 367 17ca4bf-17ca4c2 364->367 365->366 366->358 368 17ca3c4-17ca3cb 366->368 367->366 369 17ca4c8-17ca4d3 367->369 370 1817ae0 368->370 371 17ca3d1-17ca3d4 368->371 369->334 373 1817ae4-1817afc call 183f290 370->373 372 17ca3e0-17ca3ea 371->372 372->373 375 17ca3f0-17ca40c call 17ca840 372->375 373->324 379 17ca5d7-17ca5e0 375->379 380 17ca412-17ca417 375->380 382 17ca601-17ca603 379->382 383 17ca5e2-17ca5eb 379->383 380->324 381 17ca419-17ca43d 380->381 385 17ca440-17ca443 381->385 386 17ca629-17ca631 382->386 387 17ca605-17ca623 call 17b4508 382->387 383->382 384 17ca5ed-17ca5f1 383->384 388 17ca5f7-17ca5fb 384->388 389 17ca681-17ca6ab RtlDebugPrintTimes 384->389 390 17ca4d8-17ca4dc 385->390 391 17ca449-17ca44c 385->391 387->324 387->386 388->382 388->389 389->382 410 17ca6b1-17ca6b5 389->410 396 1817a3a-1817a42 390->396 397 17ca4e2-17ca4e5 390->397 393 1817ad6 391->393 394 17ca452-17ca454 391->394 393->370 398 17ca45a-17ca461 394->398 399 17ca520-17ca539 call 17ca6e0 394->399 400 17ca634-17ca64a 396->400 401 1817a48-1817a4c 396->401 397->400 402 17ca4eb-17ca4ee 397->402 404 17ca57b-17ca582 398->404 405 17ca467-17ca46c 398->405 418 17ca65e-17ca665 399->418 419 17ca53f-17ca567 399->419 406 17ca4f4-17ca50c 400->406 407 17ca650-17ca659 400->407 401->400 408 1817a52-1817a5b 401->408 402->391 402->406 404->372 411 17ca588 404->411 405->324 412 17ca46e 405->412 406->391 415 17ca512-17ca51b 406->415 407->394 413 1817a85-1817a87 408->413 414 1817a5d-1817a60 408->414 410->382 411->370 412->324 413->400 417 1817a8d-1817a96 413->417 420 1817a62-1817a6c 414->420 421 1817a6e-1817a71 414->421 415->394 417->394 422 17ca569-17ca56b 418->422 423 17ca66b-17ca66e 418->423 419->422 424 1817a81 420->424 425 1817a73-1817a7c 421->425 426 1817a7e 421->426 422->405 427 17ca571-17ca573 422->427 423->422 428 17ca674-17ca67c 423->428 424->413 425->417 426->424 429 17ca579 427->429 430 1817a9b-1817aa4 427->430 428->385 429->404 430->429 431 1817aaa-1817ab0 430->431 431->429 432 1817ab6-1817abe 431->432 432->429 433 1817ac4-1817acf 432->433 433->432 434 1817ad1 433->434 434->429
              Strings
              • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 018179D5
              • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 018179FA
              • SsHd, xrefs: 017CA3E4
              • RtlpFindActivationContextSection_CheckParameters, xrefs: 018179D0, 018179F5
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID: RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
              • API String ID: 0-929470617
              • Opcode ID: 14447bd25f17c846db8dd02733541bb8d69dfdcfd47e2288921eeb113ffd9718
              • Instruction ID: 9b8647e401041143663c5cd49dd0dd4dd550effde6b7ff1251b513a1eeb33b49
              • Opcode Fuzzy Hash: 14447bd25f17c846db8dd02733541bb8d69dfdcfd47e2288921eeb113ffd9718
              • Instruction Fuzzy Hash: 34E1F7716043058FE725CE2CC894B2AFBE5BB84B15F144A2DF956CB291F731DA45CB81
              Function 017CD770 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 372timeCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 435 17cd770-17cd7ab 436 17cd9e7-17cd9ee 435->436 437 17cd7b1-17cd7bb 435->437 436->437 438 17cd9f4-181932c 436->438 439 1819357 437->439 440 17cd7c1-17cd7ca 437->440 438->437 446 1819332-1819337 438->446 443 1819361-1819370 439->443 440->439 442 17cd7d0-17cd7d3 440->442 444 17cd7d9-17cd7db 442->444 445 17cd9da-17cd9dc 442->445 449 181934b-1819354 call 183f290 443->449 444->439 447 17cd7e1-17cd7e4 444->447 445->447 448 17cd9e2 445->448 450 17cd927-17cd938 call 17f4c30 446->450 447->439 451 17cd7ea-17cd7ed 447->451 448->451 449->439 455 17cd9f9-17cda02 451->455 456 17cd7f3-17cd7f6 451->456 455->456 458 17cda08-1819346 455->458 459 17cd7fc-17cd848 call 17cd660 456->459 460 17cda0d-17cda16 456->460 458->449 459->450 465 17cd84e-17cd852 459->465 460->459 462 17cda1c 460->462 462->443 465->450 466 17cd858-17cd85f 465->466 467 17cd865-17cd869 466->467 468 17cd9d1-17cd9d5 466->468 469 17cd870-17cd87a 467->469 470 1819563-181957b call 183f290 468->470 469->470 471 17cd880-17cd887 469->471 470->450 473 17cd8ed-17cd90d 471->473 474 17cd889-17cd88d 471->474 478 17cd910-17cd913 473->478 476 1819372 474->476 477 17cd893-17cd898 474->477 480 1819379-181937b 476->480 479 17cd89e-17cd8a5 477->479 477->480 481 17cd93b-17cd940 478->481 482 17cd915-17cd918 478->482 486 17cd8ab-17cd8e3 call 17f8250 479->486 487 18193ea-18193ed 479->487 480->479 485 1819381-18193aa 480->485 483 18194d3-18194db 481->483 484 17cd946-17cd949 481->484 488 17cd91e-17cd920 482->488 489 1819559-181955e 482->489 490 18194e1-18194e5 483->490 491 17cda21-17cda2f 483->491 484->491 492 17cd94f-17cd952 484->492 485->473 493 18193b0-18193ca call 18082c0 485->493 509 17cd8e5-17cd8e7 486->509 495 18193f1-1819400 call 18082c0 487->495 496 17cd971-17cd98c call 17ca6e0 488->496 497 17cd922 488->497 489->450 490->491 498 18194eb-18194f4 490->498 499 17cd954-17cd964 491->499 501 17cda35-17cda3e 491->501 492->482 492->499 493->509 514 18193d0-18193e3 493->514 519 1819402-1819410 495->519 520 1819417 495->520 516 1819528-181952d 496->516 517 17cd992-17cd9ba 496->517 497->450 505 1819512-1819514 498->505 506 18194f6-18194f9 498->506 499->482 507 17cd966-17cd96f 499->507 501->488 505->491 518 181951a-1819523 505->518 512 1819503-1819506 506->512 513 18194fb-1819501 506->513 507->488 509->473 515 1819420-1819424 509->515 523 1819508-181950d 512->523 524 181950f 512->524 513->505 514->493 525 18193e5 514->525 515->473 522 181942a-1819430 515->522 526 17cd9bc-17cd9be 516->526 527 1819533-1819536 516->527 517->526 518->488 519->495 521 1819412 519->521 520->515 521->473 529 1819432-181944f 522->529 530 1819457-1819460 522->530 523->518 524->505 525->473 531 1819549-181954e 526->531 532 17cd9c4-17cd9cb 526->532 527->526 528 181953c-1819544 527->528 528->478 529->530 534 1819451-1819454 529->534 535 1819462-1819467 530->535 536 18194a7-18194a9 530->536 531->450 533 1819554 531->533 532->468 532->469 533->489 534->530 535->536 539 1819469-181946d 535->539 537 18194ab-18194c6 call 17b4508 536->537 538 18194cc-18194ce 536->538 537->450 537->538 538->450 541 1819475-18194a1 RtlDebugPrintTimes 539->541 542 181946f-1819473 539->542 541->536 545 18194a3 541->545 542->536 542->541 545->536
              APIs
              Strings
              • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 01819346
              • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 0181936B
              • GsHd, xrefs: 017CD874
              • RtlpFindActivationContextSection_CheckParameters, xrefs: 01819341, 01819366
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: GsHd$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
              • API String ID: 3446177414-576511823
              • Opcode ID: 91e7214dc49cc5f06ef509308d93f3447e14619368b86e5214cee9f6b32b3d7a
              • Instruction ID: f6f9ef5a24be06a51522d5d01fc78f64d4a72f89233ab6d92b4209a15a66a9f5
              • Opcode Fuzzy Hash: 91e7214dc49cc5f06ef509308d93f3447e14619368b86e5214cee9f6b32b3d7a
              • Instruction Fuzzy Hash: 48E1A175A043428FDB24CF58C490B6AFBE5BB88718F044A7DE995DB285D770E944CB82
              Function 017FB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 546 17fb5ec-17fb5fc 547 17fb5fe 546->547 548 17fb600-17fb602 546->548 547->548 549 17fb608-17fb60d 548->549 550 17fb830-17fb844 call 17f4b87 548->550 551 17fb60f-17fb612 549->551 552 17fb621-17fb62e 549->552 551->550 554 17fb618-17fb61b 551->554 555 17fb631-17fb63d call 17fb5e6 552->555 554->550 554->552 559 17fb63f-17fb644 555->559 560 17fb64a-17fb653 555->560 559->559 561 17fb646-17fb648 559->561 562 17fb65a-17fb65d 560->562 563 17fb655-17fb658 560->563 561->555 564 17fb65f-17fb662 562->564 565 17fb665-17fb66d 562->565 563->564 564->565 566 17fb66f-17fb672 565->566 567 17fb690-17fb693 565->567 568 17fb67c-17fb680 566->568 569 17fb674 566->569 570 17fb6ad-17fb6d4 call 17f6810 567->570 571 17fb695-17fb698 567->571 574 17fb68a-17fb68d 568->574 575 17fb682-17fb684 568->575 573 17fb676-17fb67a 569->573 581 17fb6d7-17fb6e9 call 17fb5e6 570->581 571->570 576 17fb69a-17fb69e 571->576 573->570 574->567 575->574 578 17fb686-17fb688 575->578 579 17fb6a4-17fb6aa 576->579 580 17fb6a0-17fb6a2 576->580 578->573 579->570 580->570 580->579 584 17fb6eb-17fb6f1 581->584 585 17fb6f3-17fb704 call 17fb5e6 581->585 586 17fb71b-17fb727 584->586 591 17fb70a-17fb713 585->591 592 17fb791-17fb794 585->592 589 17fb729-17fb735 586->589 590 17fb797 586->590 593 17fb737 589->593 594 17fb766-17fb769 589->594 595 17fb79a-17fb79e 590->595 597 17fb718 591->597 598 17fb715 591->598 592->590 599 17fb73e-17fb741 593->599 600 17fb739-17fb73c 593->600 596 17fb76c-17fb786 call 17f6580 594->596 601 17fb7ad-17fb7b0 595->601 602 17fb7a0-17fb7a2 595->602 623 17fb789-17fb78c 596->623 597->586 598->597 605 17fb757-17fb762 599->605 606 17fb743-17fb746 599->606 600->594 600->599 607 17fb7df-17fb7ed call 183d8b0 601->607 608 17fb7b2-17fb7b5 601->608 603 17fb7a7-17fb7ab 602->603 604 17fb7a4 602->604 610 17fb815-17fb81a 603->610 604->603 605->595 614 17fb764 605->614 606->605 611 17fb748-17fb74e 606->611 630 17fb7ef-17fb7f5 607->630 631 17fb7f7-17fb7fa 607->631 612 17fb80f 608->612 613 17fb7b7-17fb7ba 608->613 621 17fb81e-17fb821 610->621 622 17fb81c 610->622 611->596 617 17fb750 611->617 618 17fb812 612->618 619 17fb7ce-17fb7d3 613->619 620 17fb7bc-17fb7c1 613->620 614->623 617->605 625 17fb752-17fb755 617->625 618->610 619->612 629 17fb7d5 619->629 620->607 626 17fb7c3-17fb7c6 620->626 627 17fb829-17fb82f 621->627 628 17fb823-17fb827 621->628 622->621 623->581 625->596 625->605 626->618 634 17fb7c8-17fb7ca 626->634 628->627 629->607 635 17fb7d7-17fb7dd 629->635 630->610 632 17fb7fc-17fb803 631->632 633 17fb805-17fb80d 631->633 632->610 633->610 634->607 636 17fb7cc 634->636 635->607 635->618 636->618
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: __aulldvrm
              • String ID: +$-$0$0
              • API String ID: 1302938615-699404926
              • Opcode ID: 3c0166d9ed1e6585338f8beb812d0714c23e94af90cb0c8803cf42abb3091ffa
              • Instruction ID: 7940fe1683dbd4291575a3d227d7bcf7927c43b364d894cd73c445cbaea726ef
              • Opcode Fuzzy Hash: 3c0166d9ed1e6585338f8beb812d0714c23e94af90cb0c8803cf42abb3091ffa
              • Instruction Fuzzy Hash: D5819070E452499EEF258E6CC8917FFFBB2AF85360F18415EDA61A7391C73498408BA1
              Function 017B9126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 637 17b9126-17b91db call 1807eb0 call 17f9020 call 17c9950 644 17b91dd-17b91ee 637->644 645 17b91f1-17b91f8 637->645 645->644 646 17b91fa-17b9201 645->646 646->644 647 17b9203-17b921f call 17ca250 646->647 647->644 650 17b9221-17b9227 647->650 651 17b922d-17b9234 650->651 652 1812518-181251d 650->652 653 17b923a 651->653 654 1812522-1812529 651->654 652->644 655 17b9241-17b929e call 17d5b20 653->655 654->655 656 181252f-1812539 654->656 655->644 659 17b92a4-17b92ba call 17d05a0 655->659 656->655 659->644 662 17b92c0-181256b RtlDebugPrintTimes 659->662 662->644 665 1812571-181257a 662->665 666 1812651-181265c 665->666 667 1812580-1812595 call 17cdd20 665->667 669 18126a0-18126a7 666->669 670 181265e-1812669 RtlDebugPrintTimes ReleaseActCtx 666->670 672 1812597-1812598 call 17c3c70 667->672 673 181259d-18125cb call 17c9950 667->673 669->644 670->669 672->673 677 1812645-181264c call 1812674 673->677 678 18125cd-18125ea call 17ca250 673->678 677->666 678->677 682 18125ec-18125f2 678->682 683 18125f4-18125f9 682->683 684 18125fb-1812638 call 17d05a0 682->684 685 181263f 683->685 684->677 688 181263a 684->688 685->677 688->685
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: $$@
              • API String ID: 3446177414-1194432280
              • Opcode ID: 98157cd49f2e518ea78262947ba25fbe06a8c881ddcadbf713ac1ec788541d0c
              • Instruction ID: a89ee2d04035de079721fb1e00db838915c38f37c0a4f023095783030e98704e
              • Opcode Fuzzy Hash: 98157cd49f2e518ea78262947ba25fbe06a8c881ddcadbf713ac1ec788541d0c
              • Instruction Fuzzy Hash: E6811DB2D002699BDB31CB54CC45BEEB7B9AF48754F1041DAEA19B7284E7305E84DFA0
              Function 017F4960 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 82timeCOMMON
              Download Yara Rule

              Control-flow Graph

              • Executed
              • Not Executed
              control_flow_graph 689 17f4960-17f498e 690 17f49b6-17f49bd 689->690 691 17f4990-17f49b0 RtlDebugPrintTimes 689->691 692 17f4a68 690->692 693 17f49c3-17f49c7 690->693 691->690 694 17f4a6d-17f4a70 691->694 692->694 693->692 696 17f49cd-17f49d5 693->696 696->692 697 17f49db-17f49df 696->697 697->692 698 17f49e5-17f49e8 697->698 698->692 699 17f49ea-17f49ee 698->699 699->692 700 17f49f0-17f49f4 699->700 700->692 701 17f49f6-17f4a4c call 17e1e46 call 17f89a0 * 3 call 17e1e46 700->701 712 17f4a4e-17f4a51 701->712 713 17f4a63-17f4a66 701->713 712->713 714 17f4a53-17f4a5d 712->714 713->692 714->713 715 17f4a5f-17f4a61 714->715 715->694
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: 0I8w$0I8w$0I8w$X
              • API String ID: 3446177414-113150377
              • Opcode ID: 2e4a1412a35e35ea7f06920e5600a3f3ce2f8c83d92dcdcb79eb59bb62b08bdd
              • Instruction ID: 840a6effc4e2d805bbf14e1d9f0f4926556c367deca4917dc9225c67ac699b7e
              • Opcode Fuzzy Hash: 2e4a1412a35e35ea7f06920e5600a3f3ce2f8c83d92dcdcb79eb59bb62b08bdd
              • Instruction Fuzzy Hash: 2E318F31D0420AFBDF22CF98D844B8FBBB1AB88754F45406DFA1596345D2789B54CF45
              Function 017DDB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133timeCOMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: , passed to %s$Invalid heap signature for heap at %p$RtlUnlockHeap
              • API String ID: 3446177414-56086060
              • Opcode ID: 6302f538c8a1d0bdc25baca7a0137bba5c0185ee49a060266c4dafdac0430a91
              • Instruction ID: 80e4d0308b2747f1262ec2b65cc11659a3f7ba777955ec5f8192f7608477accb
              • Opcode Fuzzy Hash: 6302f538c8a1d0bdc25baca7a0137bba5c0185ee49a060266c4dafdac0430a91
              • Instruction Fuzzy Hash: 41418972600349DFD722EF6CC498B6AF7B8FF40328F144569E64287295CB74AA84CB81
              Function 01834755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
              Download Yara Rule
              APIs
              Strings
              • LdrpCheckRedirection, xrefs: 0183488F
              • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01834888
              • minkernel\ntdll\ldrredirect.c, xrefs: 01834899
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
              • API String ID: 3446177414-3154609507
              • Opcode ID: 3646ffb7671c98fcc5f86816578faffcae9bf0ef1a0b3afd88f575ab830d0a3d
              • Instruction ID: b4bf2a009dcd1f77e3b9cc0f852e68da1737b231cba86cda6289eef326c7ec02
              • Opcode Fuzzy Hash: 3646ffb7671c98fcc5f86816578faffcae9bf0ef1a0b3afd88f575ab830d0a3d
              • Instruction Fuzzy Hash: 9841EF32A146559FDB22CF2DD840A26BBE4AFC9B50B0D066DED49DB311E730EA00CBD1
              Function 017DDBA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84timeCOMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: , passed to %s$Invalid heap signature for heap at %p$RtlLockHeap
              • API String ID: 3446177414-3526935505
              • Opcode ID: 1fed95dc614ccbf5432a9425f3222b94b86a3612cc75ef8eb581fc0f8a15af4b
              • Instruction ID: e2080f6117b8dec108643d772e13d13f0b82d3c50a1867c85f9513ddeb81ff3f
              • Opcode Fuzzy Hash: 1fed95dc614ccbf5432a9425f3222b94b86a3612cc75ef8eb581fc0f8a15af4b
              • Instruction Fuzzy Hash: 4F3147311447C8DFE736EB6CC419BA6FBE8EF01B10F044498E446C7696C7B8AA84CB11
              Function 017AC070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46timeCOMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: $
              • API String ID: 3446177414-3993045852
              • Opcode ID: 9d0b9ffbaed6a7b5dae1c847017786954e312fded4a1680986c5ac750323a15e
              • Instruction ID: 47620a411aef6c706a08c6221e345b77b4069a4a8534ce5c2e1121cdc5a6a77e
              • Opcode Fuzzy Hash: 9d0b9ffbaed6a7b5dae1c847017786954e312fded4a1680986c5ac750323a15e
              • Instruction Fuzzy Hash: AB112A32904618EBDF16AF98EC486AC7B71FB44764F108219F826A72D0CB756B40CF80
              Function 017DEF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
              Download Yara Rule
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID:
              • API String ID:
              • Opcode ID: 6f175ecf2228f08017fa48d6397e32616dff2e6b77d72d40cc56ac6bfae2328a
              • Instruction ID: 36c79bc2acdfd8c35573fe32adf190c9fcb5665f349823ba8c853898038725fd
              • Opcode Fuzzy Hash: 6f175ecf2228f08017fa48d6397e32616dff2e6b77d72d40cc56ac6bfae2328a
              • Instruction Fuzzy Hash: F0E12271D00608DFDB26CFA9C984AADFBF1FF48304F24456AE546A7265DB71A982CF10
              Function 0182EF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
              Download Yara Rule
              APIs
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID:
              • API String ID: 3446177414-0
              • Opcode ID: 0359e2701c4e9904b9d936ba2dd1d555ba79c1bca268c16af0f15819bca80058
              • Instruction ID: fef1b545cde7ab65ab40912655110e535a6760a8dac9cf82bcb320c3e1715950
              • Opcode Fuzzy Hash: 0359e2701c4e9904b9d936ba2dd1d555ba79c1bca268c16af0f15819bca80058
              • Instruction Fuzzy Hash: 7B713871E00629AFDF06CFA8C884ADDBBF5BF48314F54402AEA05EB254D734AA85CF54
              Function 0182F1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
              Download Yara Rule
              APIs
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID:
              • API String ID: 3446177414-0
              • Opcode ID: 8e9ff480cdce5dc12905652c7ed6a6cbee1e68d80e51f26fd66a2bb087387bc2
              • Instruction ID: 3db635b5df23bab39da0d4b6c4c0e0a36fd29bc5eda77d96e50ea5e107841a6a
              • Opcode Fuzzy Hash: 8e9ff480cdce5dc12905652c7ed6a6cbee1e68d80e51f26fd66a2bb087387bc2
              • Instruction Fuzzy Hash: 67512472E002299FDF0ACF98D849ADDBBB1FF49314F14812AEA15E7250D734AA85CF54
              Function 017E7B2F Relevance: 6.1, APIs: 4, Instructions: 81timethreadCOMMON
              Download Yara Rule
              APIs
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes$BaseInitThreadThunk
              • String ID:
              • API String ID: 4281723722-0
              • Opcode ID: 45e38e10d7862b7b099e54677c847cf42e32527a0a5b90bb3dceaf7cd8fb6f9f
              • Instruction ID: a341f3c30595a66684798b3facc957a02d3b65cc6684f25ce625471cb51a775f
              • Opcode Fuzzy Hash: 45e38e10d7862b7b099e54677c847cf42e32527a0a5b90bb3dceaf7cd8fb6f9f
              • Instruction Fuzzy Hash: D0312775E00629AFDF22DFA8D844AADBBF0BB48720F24412AE512F7294D7345E40CF64
              Function 017B59C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID: @
              • API String ID: 0-2766056989
              • Opcode ID: 2397490a1379acb7c4ef53b322dbb9af34e3b1f18339eec1a2156d57138aa008
              • Instruction ID: c3ae743da83299f093d3ae4716b8e81c0e4bafb019bf21dea4b0f516f3503cb7
              • Opcode Fuzzy Hash: 2397490a1379acb7c4ef53b322dbb9af34e3b1f18339eec1a2156d57138aa008
              • Instruction Fuzzy Hash: 04324871D0426ADFDB26DF68C884BEDFBB5BB18304F0081E9E549A7241D7749A84CF91
              Function 017F7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: __aulldvrm
              • String ID: +$-
              • API String ID: 1302938615-2137968064
              • Opcode ID: d84d73e5c23e50fb3757e9c39722a22be4762bc4311d32b0c95698253cae6a4f
              • Instruction ID: 562715d85ac5699b53b40035b55df5ad4c5fda1ab5b675ac0e85313eb4dcae7a
              • Opcode Fuzzy Hash: d84d73e5c23e50fb3757e9c39722a22be4762bc4311d32b0c95698253cae6a4f
              • Instruction Fuzzy Hash: D5919171E0020A9AEB28DF6DC881ABFFBE5AF44320F54461EEB65E73C4D73099428751
              Function 017CD02D Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240timeCOMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: Bl$l
              • API String ID: 3446177414-208461968
              • Opcode ID: a6b0afd25b13d9a80e9b9b1248db970b76cd7aec3148608e4a8d0e1488e95d05
              • Instruction ID: 6eba8fbbe5d1d1aef72d96d496ea4cf7b7acc10f49e728c737ab6e102f8a1ebf
              • Opcode Fuzzy Hash: a6b0afd25b13d9a80e9b9b1248db970b76cd7aec3148608e4a8d0e1488e95d05
              • Instruction Fuzzy Hash: E0A1C531A00319DBEB31DB98C894BAAF7B5BB44B04F0540FDD909A7245DB74AE85CF91
              Function 017F5DA4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON
              Download Yara Rule
              APIs
              • __startOneArgErrorHandling.LIBCMT ref: 017F5E34
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: ErrorHandling__start
              • String ID: pow
              • API String ID: 3213639722-2276729525
              • Opcode ID: eefde04eeb2ee4b7bde99f48d26f99f867ec1b14e21a12342dfef7bdf5a4474d
              • Instruction ID: 04251001989a726659648199eed39d7281b497d777eb0c8a148d7f8d86487591
              • Opcode Fuzzy Hash: eefde04eeb2ee4b7bde99f48d26f99f867ec1b14e21a12342dfef7bdf5a4474d
              • Instruction Fuzzy Hash: 5251497191820697E7127A2CC90536FFFD4EB40710F24C99CE7D58B39DEB7484958B46
              Function 017E4C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
              Download Yara Rule
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID:
              • String ID: 0$Flst
              • API String ID: 0-758220159
              • Opcode ID: 35807502228855cecbaf48c2cf69d69c25eb6acad6a909dbca56a37fd103ed48
              • Instruction ID: 05df29bf065aeab311ff3ae0edb10a90414fa5cef7ee3b95c8f8f144728ba3be
              • Opcode Fuzzy Hash: 35807502228855cecbaf48c2cf69d69c25eb6acad6a909dbca56a37fd103ed48
              • Instruction Fuzzy Hash: 30519DB1E00218CBDF26CF99C588669FBF5FF48318F14806AD64ADB251E7759981CB80
              Function 017DD7B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151timeCOMMON
              Download Yara Rule
              APIs
              • RtlDebugPrintTimes.NTDLL ref: 017DD959
                • Part of subcall function 017B4859: RtlDebugPrintTimes.NTDLL ref: 017B48F7
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: $$$
              • API String ID: 3446177414-233714265
              • Opcode ID: 426d154bf97ae2beb9259b0c310ca53e39c029ea2bb29229f967697834f92340
              • Instruction ID: 015771cc084150e9f1268b046e4b90fe1611c92185216a99dc5026c1e76c3178
              • Opcode Fuzzy Hash: 426d154bf97ae2beb9259b0c310ca53e39c029ea2bb29229f967697834f92340
              • Instruction Fuzzy Hash: 2951EF71E4434A9FEB31DFA8C48979DFBB2BB48304F644069C505AB289D775AA85CF80
              Function 0183CEA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON
              Download Yara Rule
              APIs
              • @_EH4_CallFilterFunc@8.LIBCMT ref: 0183CFBD
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: CallFilterFunc@8
              • String ID: @$@4Cw@4Cw
              • API String ID: 4062629308-3101775584
              • Opcode ID: 3a765c24ea19eb0a14f66c99adfd13c0b8376f8e2ca93250bfc0a5e20d586818
              • Instruction ID: 4fcb83047f21abfeba61e502f124767de895708e1b0e428d15c849466450eb25
              • Opcode Fuzzy Hash: 3a765c24ea19eb0a14f66c99adfd13c0b8376f8e2ca93250bfc0a5e20d586818
              • Instruction Fuzzy Hash: A141B371900215DFDB219F99C844AAEFBB8FF94B40F54412EE914DB354D774DA01CB91
              Function 0182FD82 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109timeCOMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: $
              • API String ID: 3446177414-3993045852
              • Opcode ID: c7bc1b42a63e77438bda4c4215b04ca135a552882c8eda90d47e03185496087f
              • Instruction ID: 6d4afaabdc52aef4b5851205882aa9917d683c9620c41de0f193366f4ecd580d
              • Opcode Fuzzy Hash: c7bc1b42a63e77438bda4c4215b04ca135a552882c8eda90d47e03185496087f
              • Instruction Fuzzy Hash: B6417179A00219ABDF12DF9DD880AEEBBB5FF48704F140119EE04AB341D7719E55CB90
              Function 017ADF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
              Download Yara Rule
              APIs
              Strings
              Memory Dump Source
              • Source File: 00000013.00000002.2235004114.00000000017A6000.00000040.00001000.00020000.00000000.sdmp, Offset: 01780000, based on PE: true
              • Associated: 00000013.00000002.2235004114.0000000001780000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001787000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001800000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001806000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.0000000001842000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A3000.00000040.00001000.00020000.00000000.sdmpDownload File
              • Associated: 00000013.00000002.2235004114.00000000018A9000.00000040.00001000.00020000.00000000.sdmpDownload File
              Joe Sandbox IDA Plugin
              • Snapshot File: hcaresult_19_2_1780000_VajtonZVfAG.jbxd
              Similarity
              • API ID: DebugPrintTimes
              • String ID: 0$0
              • API String ID: 3446177414-203156872
              • Opcode ID: dac536ea437acfe71766e0b37f4d7dc3f43fa05ba0db60e91c01c5e9a30459ab
              • Instruction ID: b0281fb03a482adf9e28d842b2db172a39f52fce659a11ed41f6fff5c62e4fee
              • Opcode Fuzzy Hash: dac536ea437acfe71766e0b37f4d7dc3f43fa05ba0db60e91c01c5e9a30459ab
              • Instruction Fuzzy Hash: 1A416BB16087069FD311CF68C884A57BBE4BB88318F444A6EF988DB341D771EA05CB96