Edit tour

Windows Analysis Report
z52PaymentSlip.exe

Overview

General Information

Sample name:	z52PaymentSlip.exe
Analysis ID:	1528613
MD5:	e6e226e5d3b722773e0269b3b80d3a57
SHA1:	73d69cfe75a715dbff9b821fe50bd820c1ecbd0a
SHA256:	74a2d7feba54ab5bc3788d420fc90cc0905f6721137fb07c071ec0d758b6b90d
Tags:	exeuser-Porcupine
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to detect virtual machines (SLDT)

Detected potential crypto function

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

z52PaymentSlip.exe (PID: 6196 cmdline: "C:\Users\user\Desktop\z52PaymentSlip.exe" MD5: E6E226E5D3B722773E0269B3B80D3A57)

WerFault.exe (PID: 2916 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 1472 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: z52PaymentSlip.exe	ReversingLabs: Detection: 36%
Source: z52PaymentSlip.exe	Virustotal: Detection: 35%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: z52PaymentSlip.exe

Joe Sandbox ML: detected

Source: z52PaymentSlip.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: z52PaymentSlip.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Accessibility.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb0[ source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdb3 source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: tc.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !!.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Lhaz.pdbpdbhaz.pdb_ source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb# source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdbSHA256- source: z52PaymentSlip.exe
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbt source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb@ source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: n(C:\Windows\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\exe\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\Lhaz.pdb+ source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Lhaz.pdbh source: z52PaymentSlip.exe, 00000000.00000002.1804874734.00000000071CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\z52PaymentSlip.PDB source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb' source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdba source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbs source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdbs\Lhaz.pdbpdbhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\z52PaymentSlip.PDB source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: o.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdb source: z52PaymentSlip.exe, WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp, WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdbR source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb. source: z52PaymentSlip.exe, 00000000.00000002.1804874734.00000000071CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oC:\Users\user\Desktop\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER1EE2.tmp.dmp.4.dr

Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: z52PaymentSlip.exe

Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Code function: 0_2_04F4D55C	0_2_04F4D55C
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Code function: 0_2_07380040	0_2_07380040
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Code function: 0_2_07382900	0_2_07382900

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 1472

Source: z52PaymentSlip.exe, 00000000.00000000.1656080058.0000000000732000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLhaz.exed" vs z52PaymentSlip.exe
Source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z52PaymentSlip.exe
Source: z52PaymentSlip.exe	Binary or memory string: OriginalFilenameLhaz.exed" vs z52PaymentSlip.exe

Source: z52PaymentSlip.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: z52PaymentSlip.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb#

Source: classification engine

Classification label: mal64.evad.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6196
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Mutant created: NULL

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\239d71e1-6a6c-4012-8475-97db85e4526c

Jump to behavior

Source: z52PaymentSlip.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z52PaymentSlip.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z52PaymentSlip.exe	ReversingLabs: Detection: 36%
Source: z52PaymentSlip.exe	Virustotal: Detection: 35%

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

File read: C:\Users\user\Desktop\z52PaymentSlip.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\z52PaymentSlip.exe "C:\Users\user\Desktop\z52PaymentSlip.exe"
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 1472

Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: z52PaymentSlip.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z52PaymentSlip.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: z52PaymentSlip.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Accessibility.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Xml.pdb0[ source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdb3 source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: tc.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !!.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Users\user\Desktop\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Lhaz.pdbpdbhaz.pdb_ source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb# source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdbSHA256- source: z52PaymentSlip.exe
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbt source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb@ source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: n(C:\Windows\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\exe\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\Lhaz.pdb+ source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Lhaz.pdbh source: z52PaymentSlip.exe, 00000000.00000002.1804874734.00000000071CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: C:\Users\user\Desktop\z52PaymentSlip.PDB source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb' source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdba source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbs source: z52PaymentSlip.exe, 00000000.00000002.1804874734.0000000007190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Configuration.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdbs\Lhaz.pdbpdbhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\z52PaymentSlip.PDB source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: o.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdb source: z52PaymentSlip.exe, WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp, WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802788912.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: Lhaz.pdbR source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb. source: z52PaymentSlip.exe, 00000000.00000002.1804874734.00000000071CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oC:\Users\user\Desktop\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802433981.0000000000B57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\Lhaz.pdb source: z52PaymentSlip.exe, 00000000.00000002.1802557677.0000000000D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER1EE2.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER1EE2.tmp.dmp.4.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: z52PaymentSlip.exe, mainForm.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: z52PaymentSlip.exe, mainForm.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.z52PaymentSlip.exe.5230000.5.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.z52PaymentSlip.exe.2ac2c48.0.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: z52PaymentSlip.exe

Static PE information: 0xE536B0FB [Sat Nov 10 20:58:35 2091 UTC]

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

Code function: 0_2_07386571 push ebx; retf

0_2_07386572

Source: z52PaymentSlip.exe

Static PE information: section name: .text entropy: 7.943594441024244

Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Memory allocated: 4A60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

Code function: 0_2_04F4C888 sldt word ptr [F64B18B9h]

0_2_04F4C888

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Users\user\Desktop\z52PaymentSlip.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z52PaymentSlip.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\z52PaymentSlip.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	3 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	3 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Software Packing	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
z52PaymentSlip.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
z52PaymentSlip.exe	35%	Virustotal		Browse
z52PaymentSlip.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	z52PaymentSlip.exe, 00000000.00000002.1804501270.0000000006C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528613
Start date and time:	2024-10-08 04:31:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z52PaymentSlip.exe
Detection:	MAL
Classification:	mal64.evad.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): fs.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:31:58	API Interceptor	1x Sleep call for process: z52PaymentSlip.exe modified
22:32:12	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_z52PaymentSlip.e_81b304cbfbfc784529105c3cf58a7151c27630_2cbdbcef_43d185f2-cf9b-406c-8b79-ea305d7fae60\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1804206372134172
Encrypted:	false
SSDEEP:	192:ChRNZZhRkd0BU/6aeOJo1ZrtmYzuiFQZ24IO8aS:KNZZhueBU/6aZdYzuiFQY4IO8aS
MD5:	28C5480ACFC7456CC1F16B7ACEB28B9E
SHA1:	0E825BD7AA0FED7F4CA242A24CD927DE547A410C
SHA-256:	F8BB705C9A74DF035ACBE4E418F5D3B0559B9877CE641E2AD9AEB0F26D7188B0
SHA-512:	9B6202C5AD3C5D34AF8E9D44C500CAE38B40EFEF667DF63BC88575BC452A894D270B7F4C4F03F75D09ECFDE33FC913BB99747CA0B04E6EF0F8D1C931EFE38A81
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.8.3.1.9.8.5.5.1.2.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.8.3.2.0.4.1.7.6.2.1.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.3.d.1.8.5.f.2.-.c.f.9.b.-.4.0.6.c.-.8.b.7.9.-.e.a.3.0.5.d.7.f.a.e.6.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.e.d.d.7.4.8.2.-.2.1.f.c.-.4.8.a.9.-.a.e.5.b.-.a.3.e.3.9.1.a.9.9.b.a.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.z.5.2.P.a.y.m.e.n.t.S.l.i.p...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.L.h.a.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.3.4.-.0.0.0.1.-.0.0.1.4.-.6.7.c.b.-.2.4.3.f.2.a.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.d.2.0.a.0.7.8.5.1.0.9.a.5.a.a.c.3.7.5.d.d.2.8.f.3.e.f.4.7.3.8.0.0.0.0.0.0.0.0.!.0.0.0.0.7.3.d.6.9.c.f.e.7.5.a.7.1.5.d.b.f.f.9.b.8.2.1.f.e.5.0.b.d.8.2.0.c.1.e.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EE2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 8 02:32:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	302673
Entropy (8bit):	4.204038158234258
Encrypted:	false
SSDEEP:	3072:gLOaCk0mc4uEqqyqLTgL3C5Jpded3bC/fnzKV:gLbCvmc4ryITgTC5s9bE
MD5:	04A36A4D842A06B932C4D47B5F3F22C1
SHA1:	9C7769EB9E2BB5D19586AC334C558240C2378F5F
SHA-256:	42E628C2DF29D3D512003FCE48459A3F88A7319A711AF7B8536CC02E0A5833A9
SHA-512:	6A2C03EF7C52A176EAC178F6B264A653437A59004ABD3B4F261B4BDB5AFA2F4E6B280F7F6A3EF13B5D7489E3590650499C78C9BF61F1A2BA894F1E3489592319
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g............................(.......$....&......T....S..........`.......8...........T............9..qd...........&...........(..............................................................................eJ......\)......GenuineIntel............T.......4......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER204B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8446
Entropy (8bit):	3.703932725722764
Encrypted:	false
SSDEEP:	192:R6l7wVeJI46kng36Y9BSU9P4QGgmfZPY+pri89bUQ3sfE8m:R6lXJ3676YbSU9P2gmfBY4UQ8fm
MD5:	65F49AE1004AB07906F8824FA1C24935
SHA1:	2A5122FFABA57015E5E743241C43534902AB1D76
SHA-256:	451FF9489618623AF3700A721099CB60358765F8D7EDC6564B9A376481143B05
SHA-512:	FFA5E0064915758DFD2DBD549DD0AA34EB35631605781197659E3C23BB021059240707DFC76825E3B4ABEB6655348C65C2B5367C2422999CAA03453C98C03EE1
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER206B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4785
Entropy (8bit):	4.517368427863469
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9ATWpW8VY3Ym8M4Jv2FQvpn+q8v4Jdpnl7tcd:uIjf6I7mi7VDJXvlKYnl7tcd
MD5:	3F08B824745E69A7EDE000551AF2CAA4
SHA1:	9F46EFAAFA283C990CCAC194E3ADC72C5EF4215F
SHA-256:	9535841FA3C0C18DB61FE4D718A866FAE1AEA3A1FCD10B4130F7EA448E0C3768
SHA-512:	3AF0B7551B6050E12B3DA66F8DDEB72B987EF8F1CAA544E6A934230FB2EFC046135E3D5784188390886D58E174626FACC6CD50569DF865FE97245AC11CE682DE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533854" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465694400220846
Encrypted:	false
SSDEEP:	6144:vIXfpi67eLPU9skLmb0b4NWSPKaJG8nAgejZMMhA2gX4WABl0uN/dwBCswSbb:AXD94NWlLZMM6YFHR+b
MD5:	46ADEAEB3DA8A83F03C4D69F62362414
SHA1:	2F8667503CEACDD9CA0E69A51EF62440416E9F28
SHA-256:	D085F5B2FB87E99E44662BAF1639F083F2CE7E574A999E9264969EF8FF8D4ECA
SHA-512:	C9F5DF3EFB4E9D53DB7E2946275E800E8716669CFF34C5B3580836377498F7541A11E09B514CACEC0CE2E03F9594C17AAB9E3658FF8C73BA99F28FE086E6D963
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmV.)@*................................................................................................................................................................................................................................................................................................................................................#>t........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.719850388732583
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	z52PaymentSlip.exe
File size:	591'872 bytes
MD5:	e6e226e5d3b722773e0269b3b80d3a57
SHA1:	73d69cfe75a715dbff9b821fe50bd820c1ecbd0a
SHA256:	74a2d7feba54ab5bc3788d420fc90cc0905f6721137fb07c071ec0d758b6b90d
SHA512:	86bbf87f68706915c27497c6fc15c178a3d2f2b58be24e0dc10f9f00f5fd0075da270977269ae5182b17234db701ab7eaabe5addb3e3a11576fa52fff1a2967c
SSDEEP:	12288:7G5mU+8y3DOgLnwxxF5E8gnTlgHaDxO8x8INPCLbP:ixyBDSxFFgnJgHaVO8IP
TLSH:	DDC4F111F6C94565E8B824FB543578CC13A2AA4DDCABF6B96BBCB54CCD332C1EE04641
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6...............0.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	d3d0deeae2f2c6c2

Static PE Info

General

Entrypoint:	0x481292
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE536B0FB [Sat Nov 10 20:58:35 2091 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8123f	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0x10ec4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x94000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7e97c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7f298	0x7f400	91fa7660149c18961886bbf9c06ed106	False	0.9528525601669942	data	7.943594441024244	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0x10ec4	0x11000	563e7253e32c9831bf01116257927085	False	0.07704790900735294	data	3.806857517201534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x94000	0xc	0x200	dd62eb747c68db6e3f493548fdc6beaa	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x82130	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/m	0.06794924878741275
RT_GROUP_ICON	0x92958	0x14	data	1.0
RT_VERSION	0x9296c	0x36c	data	0.4041095890410959
RT_MANIFEST	0x92cd8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: z52PaymentSlip.exePID: 6196, Parent PID: 2580

General

Target ID:	0
Start time:	22:31:57
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\z52PaymentSlip.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z52PaymentSlip.exe"
Imagebase:	0x730000
File size:	591'872 bytes
MD5 hash:	E6E226E5D3B722773E0269B3B80D3A57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 2916, Parent PID: 6196

General

Target ID:	4
Start time:	22:31:59
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 1472
Imagebase:	0x660000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: z52PaymentSlip.exePID: 6196, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	37
Total number of Limit Nodes:	1

Executed Functions

Function 07382900 Relevance: 6.1, Strings: 4, Instructions: 1099COMMON

Download Yara Rule

Strings

(o^q, xrefs: 07382FE8
4'^q, xrefs: 07382924
4'^q, xrefs: 073835E3
4'^q, xrefs: 07382A2B

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: 6ec78d6915ae666263d39110a4ec162e52ac59a3755feb5fbfbfc06af5bd89c9
Instruction ID: 3afb007a64c915c44238e28728b9e6115caecf171aec53f11b050754c89e049d
Opcode Fuzzy Hash: 6ec78d6915ae666263d39110a4ec162e52ac59a3755feb5fbfbfc06af5bd89c9
Instruction Fuzzy Hash: 24A29FF160020ACFDB55DF68C884AAEBBB6FF88710F158559E409DB361DB34E981CB51

Function 07380040 Relevance: 5.3, Strings: 4, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 073801C0
(o^q, xrefs: 0738013A
,bq, xrefs: 073801B2
(o^q, xrefs: 07380148

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: e526efc5e6f17bf1c04eb49306a689531c677e239b37b47662f083ac67310814
Instruction ID: 688174ed7bbb0d8d3791ebe1bc19812f9fe32257ba04a90eaa9e975377a43d2c
Opcode Fuzzy Hash: e526efc5e6f17bf1c04eb49306a689531c677e239b37b47662f083ac67310814
Instruction Fuzzy Hash: E9D190B0A10219CFEB98DFA8C984A9DBBF6FF88300F558165E419AB260D770ED45CF50

Function 07386F9C Relevance: 22.9, Strings: 18, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07387319
fcq, xrefs: 073872D2
$^q, xrefs: 07387221
XX^q, xrefs: 07387071
XX^q, xrefs: 07387124
$^q, xrefs: 0738730D
$^q, xrefs: 07387211
XX^q, xrefs: 07387023
fcq, xrefs: 0738741A
$^q, xrefs: 073872F7
fcq, xrefs: 073872E2
Te^q, xrefs: 07387164
$^q, xrefs: 073873BB
XX^q, xrefs: 07387033
fcq, xrefs: 0738740A
XX^q, xrefs: 07387105
Te^q, xrefs: 07387170
XX^q, xrefs: 07387156

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: fcq$ fcq$ fcq$ fcq$Te^q$Te^q$XX^q$XX^q$XX^q$XX^q$XX^q$XX^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-4184121725
Opcode ID: 2c4856b05a6446d95ea84efa46059f01abf91dc8600aa340db5570b534cd0816
Instruction ID: 60734512a4c80538123483e2f2e64aa914600e787cf7f9c5ecba3813c8a72d49
Opcode Fuzzy Hash: 2c4856b05a6446d95ea84efa46059f01abf91dc8600aa340db5570b534cd0816
Instruction Fuzzy Hash: 1ED1A1B0F14319CFEB58AAE8C84466DBBB7BB85700F344415E406AF798CB759C46CB91

Function 07386CDF Relevance: 21.8, Strings: 17, Instructions: 505COMMON

Download Yara Rule

Strings

fcq, xrefs: 07386E0E
fcq, xrefs: 073872D2
XX^q, xrefs: 07387071
XX^q, xrefs: 07387124
$^q, xrefs: 0738730D
$^q, xrefs: 07387211
XX^q, xrefs: 07387023
fcq, xrefs: 07386E1E
$^q, xrefs: 073872F7
fcq, xrefs: 07386DEE
Te^q, xrefs: 07387164
$^q, xrefs: 073873BB
fcq, xrefs: 0738740A
fcq, xrefs: 07386DE2
fcq, xrefs: 07386E94
XX^q, xrefs: 07387105
XX^q, xrefs: 07387156

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: fcq$ fcq$ fcq$ fcq$ fcq$ fcq$ fcq$Te^q$XX^q$XX^q$XX^q$XX^q$XX^q$$^q$$^q$$^q$$^q
API String ID: 0-1707326010
Opcode ID: 08966b804edfc602c35e66cb0f6c20f88046e58ed15aa8ae8eae0db16621bd06
Instruction ID: 24f581cebe70387138453e9296bebb6cb9774e7c2e71333292f97165774025d5
Opcode Fuzzy Hash: 08966b804edfc602c35e66cb0f6c20f88046e58ed15aa8ae8eae0db16621bd06
Instruction Fuzzy Hash: A812B1F0A10318CFFB54AF98C945BADB7B7BB85300F248426E40AAF695CB749C45CB91

Function 07380528 Relevance: 10.7, Strings: 8, Instructions: 734COMMON

Download Yara Rule

Strings

(o^q, xrefs: 07380B27
(o^q, xrefs: 073807DA
(o^q, xrefs: 07380711
,bq, xrefs: 07380AB8
(o^q, xrefs: 07380B37
,bq, xrefs: 07380AC8
(o^q, xrefs: 07380656
(o^q, xrefs: 0738073D

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 62154fb2cd4f6973c8bdc933a8d945144b872c5d9362ccd0c352cc5a9441f073
Instruction ID: 5e55cf405dd38294da5f75cf405bef82d7a0d06209b07abb2ae27b9feb31eb47
Opcode Fuzzy Hash: 62154fb2cd4f6973c8bdc933a8d945144b872c5d9362ccd0c352cc5a9441f073
Instruction Fuzzy Hash: 9D525CB16002058FEB59EF68C584AAEBBF5EF49314F148169E819DB361DB30ED49CB50

Function 07387139 Relevance: 10.2, Strings: 8, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0738730D
$^q, xrefs: 07387211
$^q, xrefs: 073872F7
Te^q, xrefs: 07387164
fcq, xrefs: 073872D2
$^q, xrefs: 073873BB
fcq, xrefs: 0738740A
XX^q, xrefs: 07387156

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: fcq$ fcq$Te^q$XX^q$$^q$$^q$$^q$$^q
API String ID: 0-3622600923
Opcode ID: f490c54c8a8aaf2b0623e55724b00e33f52f39fe55f8a1922b7477bda3b1321d
Instruction ID: 0ff6b9415faaf646c934577e7017c755d7ba7c79ef0570f378a6c08f2ac50d81
Opcode Fuzzy Hash: f490c54c8a8aaf2b0623e55724b00e33f52f39fe55f8a1922b7477bda3b1321d
Instruction Fuzzy Hash: CB719FF0E14319CFFBA8AAD4C444AADB7B7FB81700F348416E40AABA94C7749C45CB91

Function 07385B50 Relevance: 7.6, Strings: 6, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 07385CFB
$^q, xrefs: 07385C1E
$^q, xrefs: 07385C10
$^q, xrefs: 07385D20
LR^q, xrefs: 07385B8A
$^q, xrefs: 07385D14

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q$$^q$$^q
API String ID: 0-4154641970
Opcode ID: f4568a0bee49f61d6da75b75c79aa70aaeea98f40a0701dc9dc4a507028b9b6d
Instruction ID: d38d55dc25fa5ceea40ce86bec32f8ff877bf05454fabda57a4e68d6b5a039d6
Opcode Fuzzy Hash: f4568a0bee49f61d6da75b75c79aa70aaeea98f40a0701dc9dc4a507028b9b6d
Instruction Fuzzy Hash: 5E51F2B1B1030ACFEF54AF69C80577AB6FAFB85700F14842AE5099F381DB748855CB50

Function 07385762 Relevance: 4.4, Strings: 3, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07385C10
LR^q, xrefs: 07385B8A
$^q, xrefs: 07385D14

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: LR^q$$^q$$^q
API String ID: 0-3333519130
Opcode ID: 4e5a4c3238c2637a435fde9afb9ec7276ac0e7553a6e9f6834a9ee22e56081e3
Instruction ID: 2cfbeb4652fb3e3dd5b39e4cff70841ead779aec7855541ae70f8c01c221795f
Opcode Fuzzy Hash: 4e5a4c3238c2637a435fde9afb9ec7276ac0e7553a6e9f6834a9ee22e56081e3
Instruction Fuzzy Hash: 4991F76295E3E18FEB136B3898606EA7FB0AF53210F0941E7D0C4CF1A3D5784959C766

Function 073858E0 Relevance: 4.2, Strings: 3, Instructions: 435
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07385C10
LR^q, xrefs: 07385B8A
$^q, xrefs: 07385D14

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: LR^q$$^q$$^q
API String ID: 0-3333519130
Opcode ID: c7a80fdf4307c41e116d080dc5d6611da7c0781ed100e9cc1d9b2784ef0afea5
Instruction ID: a54959c0b4d1a723c91066a07425b7acbc278a4eaf1ed0205dc8b6b389e1f177
Opcode Fuzzy Hash: c7a80fdf4307c41e116d080dc5d6611da7c0781ed100e9cc1d9b2784ef0afea5
Instruction Fuzzy Hash: 7A4135F2A1030ACBFF55AF64C845BBAB7F9FB95700F14842AE549AB281D7748855CB10

Function 07383E58 Relevance: 2.9, Strings: 2, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 07383E91
(o^q, xrefs: 07383EB5

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: (o^q$(o^q
API String ID: 0-1946778100
Opcode ID: c8af07a476f69f8b068a9c5972d49bb3dbe4ad8a4a58a329a032b2c659e7c85d
Instruction ID: e604e43810ee50337171092e64ba100d89def48f052adc79985fc32bbd43133c
Opcode Fuzzy Hash: c8af07a476f69f8b068a9c5972d49bb3dbe4ad8a4a58a329a032b2c659e7c85d
Instruction Fuzzy Hash: AEF14AB0A0425A9FDB51DF94C580DAEBBFAFF89300F55C515E919A76A4C730F881CBA0

Function 07381A18 Relevance: 2.6, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07381AD4
$^q, xrefs: 07381AF7

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 5f829462f91382f54bfb99c3c47e8c956ae9b39d261e2edda9e00357e1603f92
Instruction ID: 00b6e7e2a198b02b04b644d047850f385669c040139e6ca37c8dd0810db8a0f8
Opcode Fuzzy Hash: 5f829462f91382f54bfb99c3c47e8c956ae9b39d261e2edda9e00357e1603f92
Instruction Fuzzy Hash: 8F11A5F074431A4FEB6AABA9989053E3B6AAB85650714085ED05ACB351EF38CC838352

Function 07381BB8 Relevance: 2.5, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 07381BD1
4'^q, xrefs: 07381BF7

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 9244861eacd57557f2b2001c7fff06f44e093a0f248ad28f2be62fbca5ed1f3e
Instruction ID: cd633665df761aadb069aefa7a9b99c749bf38da027f9d886bf73e0473103d45
Opcode Fuzzy Hash: 9244861eacd57557f2b2001c7fff06f44e093a0f248ad28f2be62fbca5ed1f3e
Instruction Fuzzy Hash: B3E086F079521E17E67D216A491466E784ED7C5B50F14055DB41EC7344FE64CCC34262

Function 04F4AD48 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F4AF9E

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 87462e6a7d8aadbfd03f2e3c4f244e751b4cb9aaa465ed71731d351415e2ab20
Instruction ID: 060e590e1abec141e55aaa32bfc3a8a4a4ad624c60293dee99ce0c8fcdfcb217
Opcode Fuzzy Hash: 87462e6a7d8aadbfd03f2e3c4f244e751b4cb9aaa465ed71731d351415e2ab20
Instruction Fuzzy Hash: 58710270A00B058FDB24DF2AD45475ABBF1FF88304F048A2DD49A97A50DB75F94ACB91

Function 04F4590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04F459C9

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7ca48196922547d768b7879c9ba9a67a17211635b8d2079eb97d0b30bb987225
Instruction ID: 8d444443da6069b772425b7bbd0fa2a28990f4c39e5e15692ce6ada8596d5617
Opcode Fuzzy Hash: 7ca48196922547d768b7879c9ba9a67a17211635b8d2079eb97d0b30bb987225
Instruction Fuzzy Hash: 0341E2B0C0161DDFDB24DFA9C8847DEBBB5BF48304F24806AD408AB255DB75698ACF91

Function 04F444C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04F459C9

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3fd78dc898e4adc55cdedcd0e94210af13d99f3b1c43f6c0d90ac74ed03b3864
Instruction ID: d6a96b8c37a4e575abd77f91a94ba32b0a89dc8637fafbe3d46e32ecf98de5c1
Opcode Fuzzy Hash: 3fd78dc898e4adc55cdedcd0e94210af13d99f3b1c43f6c0d90ac74ed03b3864
Instruction Fuzzy Hash: EC41F3B0C0071DDBDB24DFAAC88479EBBB5BF48304F60806AD408AB251DB75A946CF91

Function 04F4D21C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04F4D5F6,?,?,?,?,?), ref: 04F4D6B7

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: eecbc3ccaf1fbbb3d20c061e687615c43fc8e70206ffddda1a4db7d9e3a55920
Instruction ID: b7f9413d0983d7a9f521339a410107c3abe22888d496ae9d74b08cfa7657ee36
Opcode Fuzzy Hash: eecbc3ccaf1fbbb3d20c061e687615c43fc8e70206ffddda1a4db7d9e3a55920
Instruction Fuzzy Hash: AD21E4B5900258EFDB10CF9AD584AEEBFF8EB48320F14841AE918B7311D374A944CFA5

Function 04F4D628 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04F4D5F6,?,?,?,?,?), ref: 04F4D6B7

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f8f6ea249c7c3cc8552f8409f51fc9f1f23a05e6192fec30d78f2bb02f97cb11
Instruction ID: ab3f0b897512a47fad96c8c6535662f2d406c4a5d13032483c70a2ddd27446bb
Opcode Fuzzy Hash: f8f6ea249c7c3cc8552f8409f51fc9f1f23a05e6192fec30d78f2bb02f97cb11
Instruction Fuzzy Hash: A42114B5D002589FDB10CFA9D584AEEBFF4EB48310F14841AE818A3311C334A940CFA5

Function 04F4AF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F4AF9E

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9211acce08106e297a8e8b90ffd865e46cffac48149e463d9fd4dcdd1f58f554
Instruction ID: 6a3daa32b67b085507ddfc391fb71ba760d960c3f2bbba43d2a3a35bf1b48bc7
Opcode Fuzzy Hash: 9211acce08106e297a8e8b90ffd865e46cffac48149e463d9fd4dcdd1f58f554
Instruction Fuzzy Hash: 4F11EDB6C003498FDB10CF9AD444ADEFBF4EB88324F10846AD869A7610D779A545CFA5

Function 07383C00 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396bf2d3427b44ffeb6b73d7ca34f0dc7725ed068d658739f8f299ebc88f5c63
Instruction ID: 28cc5db3d8ebdfa9e41dc3121f29733bd29b021775ad4a9c4fb4635abffb51fc
Opcode Fuzzy Hash: 396bf2d3427b44ffeb6b73d7ca34f0dc7725ed068d658739f8f299ebc88f5c63
Instruction Fuzzy Hash: 8E615EB2E007499FEF55DFA5C54069DFBF2AF8A700F248619E849AB341D770A945CF40

Function 073850E9 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ab8f4c40e825c20201ea960173872869c7a7afd5dadb2e6f8bb12782ef2254
Instruction ID: 50888befebe5a9c544fb3e961d95a119df54dd728d24b31cd3bc803e904e35fe
Opcode Fuzzy Hash: e6ab8f4c40e825c20201ea960173872869c7a7afd5dadb2e6f8bb12782ef2254
Instruction Fuzzy Hash: 57519031F042049BD704AB74D545AAEBBB2BF89300F14C4A9E8526B29ACF756D89C7D1

Function 073850F8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45f9991a313cad96355b3270b42d80ff3eebedc0916630af72f280ab20aa30e
Instruction ID: 99e82427c20cf5b38d07f6928e28e2a23300570e82f298702479f55dc0fe0a8f
Opcode Fuzzy Hash: c45f9991a313cad96355b3270b42d80ff3eebedc0916630af72f280ab20aa30e
Instruction Fuzzy Hash: 0E51B031F042049BD704AB74D545AAEBBB2BF89300F14C4A9E8926F39ACF756D89C7D1

Function 07383BF1 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0d053969b95830bd7c29885799d3f7f536ebde65296918b90724477d45fc92
Instruction ID: d1d41a6cb9e4768fb267b7d9e4be7a0faa6b77c9c0119a9c8b865c49b1dc4ab9
Opcode Fuzzy Hash: cc0d053969b95830bd7c29885799d3f7f536ebde65296918b90724477d45fc92
Instruction Fuzzy Hash: 62514CB2E007499FEF51DFA5C5406DDBBF2AF89700F24861AE849AB341D770A949CF10

Function 07382DD3 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958f4bf431c06ccadf351b8759c410a4556274f94eabddeb9ef049c9eeb44ec5
Instruction ID: 9288c5e94c5c5de411703959e9346e51edf97186e6f447e42c870b6803153f15
Opcode Fuzzy Hash: 958f4bf431c06ccadf351b8759c410a4556274f94eabddeb9ef049c9eeb44ec5
Instruction Fuzzy Hash: FC418DB1A00349DFEF51DFA4C844A9EBFB6FF49310F048156E819AB2A1D731E954CB94

Function 073854A8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40751189ceadd81609780634b26b0824b39410f83a7c98e95abeb05f583529b1
Instruction ID: b7829e17c116153f1f88e3e1a71b8fc76960a460c44b2bc14d1551703a88a64d
Opcode Fuzzy Hash: 40751189ceadd81609780634b26b0824b39410f83a7c98e95abeb05f583529b1
Instruction Fuzzy Hash: 3A417FB0D15208DFDB44EFA9C69455EBBF2FF41304F28D89AD02A5B365DB348A45CB81

Function 0738531E Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d8b61faa3983d6610396b0c64181bee36995077aea8b02082fddb0c9e048ed
Instruction ID: 3e924a13ccff6b602b6810cafb5b6b557ccaf7b5251036a7aac7dee78f454e1d
Opcode Fuzzy Hash: 84d8b61faa3983d6610396b0c64181bee36995077aea8b02082fddb0c9e048ed
Instruction Fuzzy Hash: EA31F4B471C3804FE7065778D8257293FF59B8A210F1944ABE456CB2D3CEB98C45C762

Function 07384F58 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae4913b5537cb85b1e251ca81d65cb0fa0398a35eb6715d5d8e9e5bb36db8b4
Instruction ID: edc96b39a5170b22c0bc16aaece739e74161652c03fbc3ac939994b4fe1f1b8d
Opcode Fuzzy Hash: 2ae4913b5537cb85b1e251ca81d65cb0fa0398a35eb6715d5d8e9e5bb36db8b4
Instruction Fuzzy Hash: 86312BF09103099FEB40AF68D94579E7BF5FB4A310F100869E11ADB780EB399C548BD2

Function 07380EA0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31608a1308ae37bbd62f6b269b027348c9bc7cb2d177472777d7afef917df1ff
Instruction ID: d4e037a16bd83238ed7e87d9326de865362565d3c7a2e2b02928a1e574260c0b
Opcode Fuzzy Hash: 31608a1308ae37bbd62f6b269b027348c9bc7cb2d177472777d7afef917df1ff
Instruction Fuzzy Hash: 91217FB13053128BFB682636D4D463E7A9AAFC5A58F14C039E50ACB794EE39CC46D381

Function 07385360 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afe7b26e1800893abc88627ec30496f81f5c40c8cb3fdd5fa9e1b919de4a0e5
Instruction ID: 433a7118201a5846a034c8ef9d6926c023b046eb8408570403e8d6e85c9c4972
Opcode Fuzzy Hash: 8afe7b26e1800893abc88627ec30496f81f5c40c8cb3fdd5fa9e1b919de4a0e5
Instruction Fuzzy Hash: 972135B47183048FE7446B78D85972A3FE6AB89310F144476F41AC73D5CEB68C41C751

Function 00FAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802960818.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fad000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ca550d8804fb66c120c3600914de7b5a0183cee377c312d5e24115dfb604a8
Instruction ID: 8f9669da02218e72b642ad3951970526a68ffcf76843c7c2fe10f7d760ebecce
Opcode Fuzzy Hash: 60ca550d8804fb66c120c3600914de7b5a0183cee377c312d5e24115dfb604a8
Instruction Fuzzy Hash: F52148B2500200DFDB04DF04C9C0B16BF65FB98324F20C169DC0A0B656C336E846E6A2

Function 00FBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803002998.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fbd000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a9a039f37095a382ce94fd8d328ef3db88891ca1bca060393535635a2c4dcf
Instruction ID: 0a8be2905d40af2d89d6d64e8c6228e5c8b3cb394fdb099736115e9cdaad11f1
Opcode Fuzzy Hash: 77a9a039f37095a382ce94fd8d328ef3db88891ca1bca060393535635a2c4dcf
Instruction Fuzzy Hash: 55213775604200DFCB14EF14D9C4B56BF65FB84364F20C56DD80A4B25AD33AD847DE62

Function 00FBD1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803002998.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fbd000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e51549e8f51a462550e750b6caa09df7b29c2325494abbc98ef4f795025a9a
Instruction ID: 8c2fd267c94bc624e1e2b3b5f2cf3450986e0736a9c18bb051597ea5283da346
Opcode Fuzzy Hash: a1e51549e8f51a462550e750b6caa09df7b29c2325494abbc98ef4f795025a9a
Instruction Fuzzy Hash: FB213475904280DFCB04DF14C9C0B66BBA5FB94324F20C56DD8094B396D33AD846EEA2

Function 07384EB2 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6357bc1e16205933e79251010b0d654f3decb25317ef792ff7ca77a5b24e5205
Instruction ID: 99c57e4f5c094a51617fa65adb3ba5c414fc9ff2c491c637f5695175205fcd65
Opcode Fuzzy Hash: 6357bc1e16205933e79251010b0d654f3decb25317ef792ff7ca77a5b24e5205
Instruction Fuzzy Hash: D721D1B5E00118DFDB40EFA8C980A9DBBF5FF44300B1045A6E00ADB361DB349E41DB80

Function 07387F66 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9efd1aa6b6f639c4100302b5d44b4d0e6e1fd90aec231a569837745efc3788a
Instruction ID: 0bf2048778a26a8b1457ca6688ce057ca5534559395ce8055dc87a2a0579d240
Opcode Fuzzy Hash: f9efd1aa6b6f639c4100302b5d44b4d0e6e1fd90aec231a569837745efc3788a
Instruction Fuzzy Hash: B821EEF0A1A309CFE7429FEAC440A7A77F6AF46300F244972E119CB542DB34C8058721

Function 00FBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803002998.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fbd000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9594de60b19b8dc71f29c68c7cb514585b61157ca9dcd1d9bc69e8476943bd6c
Instruction ID: dc2eabd9c2ae01727746e962ba507cfd2add544ad7d5bcd3491b96fa16c8bb83
Opcode Fuzzy Hash: 9594de60b19b8dc71f29c68c7cb514585b61157ca9dcd1d9bc69e8476943bd6c
Instruction Fuzzy Hash: 95218E755093808FCB02DF24D994755BF71EB46324F28C5EAD8498F6A7C33A980ADB62

Function 00FAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1802960818.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fad000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: e64b55d8729d9a48a1cc54548a800d74b87ec39a471d8e8c48c5ed1f6239a560
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 941126B6804240CFDB06CF00D5C4B16BF71FB98324F24C2A9DC0A0B656C33AE85ADBA1

Function 00FBD1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803002998.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fbd000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 29b5c89b4201d4afda9b7b468f3e07951f8ada6ecf1bf8062829f2b44259a13a
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5611DD75904280CFDB05CF10D5C4B55BFA2FB84328F28C6AAD8094B656C33AD80ADFA2

Function 07385698 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f676b05089b33cd6e8bbd2813579e686850561e7e823cdf5bc48a9b25c8184
Instruction ID: 23958c5a8bac30e7699f270b802e52f6356e67d3076a2595873060951faa6db9
Opcode Fuzzy Hash: 02f676b05089b33cd6e8bbd2813579e686850561e7e823cdf5bc48a9b25c8184
Instruction Fuzzy Hash: C8F0F6F26293348BE790A66C984067AB7ECF74A320F419633F55DC7681D634C89142D1

Function 07384EC0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5d8171a6cd073b8345f111de041973a7de0310c02a5c60341dd96948d78310
Instruction ID: a806b22383af4c39098d4e4d04e3bda254d4cf6fac1924a1c3484048e34a9916
Opcode Fuzzy Hash: 2e5d8171a6cd073b8345f111de041973a7de0310c02a5c60341dd96948d78310
Instruction Fuzzy Hash: F2010870D0020DAFDB40EFA8C9906AEBBF2FF45300F1085AAD116A7355EB345A45AB81

Function 07386C68 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be56995cbed515faa7c9c9056c3c791d9735b83cea6caf70e690c6167330a28
Instruction ID: c25aae2a34f061d89cedea52471fcb9bf474a9d352f0b1a3f43310b98e0ff9b5
Opcode Fuzzy Hash: 2be56995cbed515faa7c9c9056c3c791d9735b83cea6caf70e690c6167330a28
Instruction Fuzzy Hash: 0BE0C2F0B9030CBBFA6429615C07B22356EE7C0F42F208425F2095D1C5CD7694418B24

Function 07386C59 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf45a5e9d5aa8bb9e449e51b6cfe49e91d87af6bc77d0b459d9c480736af4a7a
Instruction ID: 347d0f203f5041fec6abdd90cd94e6e1093a958074cc01c6163840d3e9e1bad6
Opcode Fuzzy Hash: cf45a5e9d5aa8bb9e449e51b6cfe49e91d87af6bc77d0b459d9c480736af4a7a
Instruction Fuzzy Hash: 45E020F1D093889FF74111208D2A3223F25CB91601F1944EB91598F0C3D9385400C725

Function 07382410 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457a3dbed730ef9a837d2d5446b79025fc23655288dc24cf97d543be8b4251f4
Instruction ID: 40f25a99de943ddbc9b85af026d854ad1bc3da135399607c240bb0586b259dd0
Opcode Fuzzy Hash: 457a3dbed730ef9a837d2d5446b79025fc23655288dc24cf97d543be8b4251f4
Instruction Fuzzy Hash: ABB092A28C010063EA680A98CACA786230CC745394F144910EC0A94691C12CE60BD130

Non-executed Functions

Function 04F4D55C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10c340da43bfdb5107af48bfe0e895feccdd267a7426aaed2bbbc1d3388127a
Instruction ID: 025ff016758368b8d36b4c170aef64a1b9fea4dd6145afd1cbc9047d8e119ee3
Opcode Fuzzy Hash: d10c340da43bfdb5107af48bfe0e895feccdd267a7426aaed2bbbc1d3388127a
Instruction Fuzzy Hash: F9A16932E002198FDF05DFA4C94449EBBB2FFC5304B15816AE80AAB265EF35E946CB50

Function 04F4C888 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803560094.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f40000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbbaa82b6568593ce60ef6b4fa527a885255a048d28d5479d9cc9b5ca7cbd16
Instruction ID: 6fc91c1ca778c9368e2bef5fc2c29fad13f132f4a9a794d9e1f465b23738ffaa
Opcode Fuzzy Hash: 0cbbaa82b6568593ce60ef6b4fa527a885255a048d28d5479d9cc9b5ca7cbd16
Instruction Fuzzy Hash: A6E02BF98164804FEF11D724FDD24883B32F655304701C591D005AB797E624450F8B61

Function 07386418 Relevance: 7.8, Strings: 6, Instructions: 276COMMON

Download Yara Rule

Strings

$^q, xrefs: 073867E1
LR^q, xrefs: 073866BD
LR^q, xrefs: 073867AE
$^q, xrefs: 073867EF
$^q, xrefs: 0738650A
$^q, xrefs: 07386816

Memory Dump Source

Source File: 00000000.00000002.1805431189.0000000007380000.00000040.00000800.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_z52PaymentSlip.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q$$^q$$^q
API String ID: 0-4154641970
Opcode ID: 350e28a31bea7870efe231804a6859bc934b8e6be89425f093d0bcc55bd72148
Instruction ID: a1edaf41ee9029ac5ebb9ae8b9389a7ac2fac5ca5da1764a47612a3f82c07034
Opcode Fuzzy Hash: 350e28a31bea7870efe231804a6859bc934b8e6be89425f093d0bcc55bd72148
Instruction Fuzzy Hash: 48C15EB0E10229CFDB54DFA9C581AADB7F2FF84300F158556E419AB656D730DC82CB91

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z52PaymentSlip.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_z52PaymentSlip.e_81b304cbfbfc784529105c3cf58a7151c27630_2cbdbcef_43d185f2-cf9b-406c-8b79-ea305d7fae60\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EE2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER204B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER206B.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: z52PaymentSlip.exePID: 6196, Parent PID: 2580

General

Chronological Activities

Windows Analysis Report
z52PaymentSlip.exe

Function 07380040 Relevance: 5.3, Strings: 4, Instructions: 329
COMMON

Function 07386F9C Relevance: 22.9, Strings: 18, Instructions: 370
COMMON

Function 07387139 Relevance: 10.2, Strings: 8, Instructions: 197
COMMON

Function 07385B50 Relevance: 7.6, Strings: 6, Instructions: 144
COMMON

Function 07385762 Relevance: 4.4, Strings: 3, Instructions: 614
COMMON

Function 073858E0 Relevance: 4.2, Strings: 3, Instructions: 435
COMMON

Function 07383E58 Relevance: 2.9, Strings: 2, Instructions: 370
COMMON

Function 07381A18 Relevance: 2.6, Strings: 2, Instructions: 73
COMMON

Function 07381BB8 Relevance: 2.5, Strings: 2, Instructions: 26
COMMON

Function 04F4AD48 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Function 04F4590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 04F444C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04F4D21C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON