Edit tour

Windows Analysis Report
SwiftMessage_Unlocked_Transaction ProofMessage.exe

Overview

General Information

Sample Name:	SwiftMessage_Unlocked_Transaction ProofMessage.exe
Analysis ID:	680488
MD5:	ed3e368480ce9fdd917565b149d52e14
SHA1:	d8f888cfee5175c6d4f8da8007bf9e92cc5f0d87
SHA256:	3d547c5731a7c08b7d25c4724cb9ae8a75ce246dc2715ee0e58edbb5ec2221f8
Tags:	exeFormbook
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Adds a directory exclusion to Windows Defender

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SwiftMessage_Unlocked_Transaction ProofMessage.exe (PID: 3144 cmdline: "C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe" MD5: ED3E368480CE9FDD917565B149D52E14)

powershell.exe (PID: 4400 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5656 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SwiftMessage_Unlocked_Transaction ProofMessage.exe (PID: 1888 cmdline: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe MD5: ED3E368480CE9FDD917565B149D52E14)

explorer.exe (PID: 3616 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

cmd.exe (PID: 2896 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.familism.net/qaom/"], "decoy": ["WK4227sGKNxdtoj/0el0mSq6", "6xaJ/eBRc1Is34jYrt3HpbWWpL8=", "Q7+YyiJbcxwKABQO", "atnlwk5WXUDP", "O6yJJQ1+qofZlXOe9Tg=", "dunCiWrF4HybTdg=", "DMu9XSig1sDHpEurphKPD5I=", "0BiFGyxxBqHK9SoX", "I1T3Eo/xM+g+G8E=", "YNCVL0Gu1nybTdg=", "LK5/JglqrJNlLXsB/y8=", "GVT1r5DUEwmfRB49hQ==", "3FgVMp31AavK9SoX", "/Go/U5XV/73NRGaYz9Hj", "X5wxX+xch3fK9SoX", "7zegS4KNMpAEV88=", "6h6gMwpSYEpXCpjLqhKPD5I=", "gvSwORhos596Mc0rToo1E8p73E0xBu0BkA==", "siwQw91WgGlzSOpKMzztMvABuFg1", "Z6dAwcEocHDK9SoX", "h7Mox9lUflw78oXFrhKPD5I=", "xRSnRy6SEr9VuQ==", "d/zWB58BGMsb4xZo2gP6", "vyfkgl2Xv6k2o+IXStjUFiSiAg==", "crBR7fNVZk/nYJClIoVlzw==", "HGIDmKrWFPo=", "DI1Q7AExpQRXONI=", "/388PtNIZxpxZ/cdmFFAxw==", "5VYiHn7Y8eF43fj8L9rVFiSiAg==", "9UO3sVqQsmLF", "sXNmwsknc2xVO/RcUdHKE6fQJZm3zw==", "X9SLfeVhiWxQRB49hQ==", "j7wwN4PJAqBNr8tn+a4Aeuyt", "DE/Zg2Sr23ybTdg=", "WsyC+M8HJtukVniYIoVlzw==", "/jzqGSaiEr9VuQ==", "xSwSx8sWcl+0RB49hQ==", "qrSdt0jBEwgbg3sB/y8=", "zhiQnTF+5INt3woO", "+CK93DWQm0fDrPkh1xKPD5I=", "pOBXfOMlTw0Pd7LVml1ibSiz", "GItvoylqfzY/K4CiIoVlzw==", "/Ww8XPNtlk+qXmRHqaB0mSq6", "Uch4GPdKVzshf3sB/y8=", "zPNua9dQbiB0Vwpt7Pn4wEoTJBU9", "HZtax4/e8dM57w8bojTVvkwTJBU9", "uTlOCbAIUnBZUbsO0xKPD5I=", "XqUSspnoLSUlBHMQETY=", "rSTV4D+7Er9VuQ==", "bd3oTDOnF3ybTdg=", "pyDqCl2xul22qvLoVuGBZueCJZm3zw==", "deyiDdEUUTUaqVezL857jZ97lDP8xw==", "syQDtrscLQ2kRB49hQ==", "KlzKRxhUdxUtj9khEX3IjYLEw+Qb5X0=", "l9NbxqQUPC8vBnMQETY=", "LaiNxSxCizujRB49hQ==", "QLiHqfxYm1kshbv853KG87WWpL8=", "kOp/JDkY0qwjrg==", "GdW4A7HsB3ybTdg=", "QbqiVFmfl0Ma5Slgnh3WHeyBJZm3zw==", "DY45YM89dV+1RB49hQ==", "aqkyAuctVzMO5X3DqxKPD5I=", "WoDzipz+PStyOtgA", "lQraDqf9JQnmr/fnLin2qSey"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x65e1:$a1: 3C 30 50 4F 53 54 74 09 40 0x1e160:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x172f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x170f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1736f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa4ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15dbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb212:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1cdb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1deca:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x197f9:$sqlite3step: 68 34 1C 7B E1 0x1992c:$sqlite3step: 68 34 1C 7B E1 0x1983b:$sqlite3text: 68 38 2A 90 C5 0x19983:$sqlite3text: 68 38 2A 90 C5 0x19852:$sqlite3blob: 68 53 D8 7F 8C 0x199a5:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x65e1:$a1: 3C 30 50 4F 53 54 74 09 40 0x1e160:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x172f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x170f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1736f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa4ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15dbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb212:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1cdb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1deca:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x197f9:$sqlite3step: 68 34 1C 7B E1 0x1992c:$sqlite3step: 68 34 1C 7B E1 0x1983b:$sqlite3text: 68 38 2A 90 C5 0x19983:$sqlite3text: 68 38 2A 90 C5 0x19852:$sqlite3blob: 68 53 D8 7F 8C 0x199a5:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x55e1:$a1: 3C 30 50 4F 53 54 74 09 40 0x1d160:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x98ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x162f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x160f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x161f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1636f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x94ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14dbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa212:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1bdb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ceca:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x187f9:$sqlite3step: 68 34 1C 7B E1 0x1892c:$sqlite3step: 68 34 1C 7B E1 0x1883b:$sqlite3text: 68 38 2A 90 C5 0x18983:$sqlite3text: 68 38 2A 90 C5 0x18852:$sqlite3blob: 68 53 D8 7F 8C 0x189a5:$sqlite3blob: 68 53 D8 7F 8C
00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x65e1:$a1: 3C 30 50 4F 53 54 74 09 40 0x1e160:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa8ff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x172f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x170f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1736f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa4ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15dbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb212:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1cdb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1deca:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x197f9:$sqlite3step: 68 34 1C 7B E1 0x1992c:$sqlite3step: 68 34 1C 7B E1 0x1983b:$sqlite3text: 68 38 2A 90 C5 0x19983:$sqlite3text: 68 38 2A 90 C5 0x19852:$sqlite3blob: 68 53 D8 7F 8C 0x199a5:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x35a39:$a1: 3C 30 50 4F 53 54 74 09 40 0x62459:$a1: 3C 30 50 4F 53 54 74 09 40 0x8de79:$a1: 3C 30 50 4F 53 54 74 09 40 0x4d5b8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x79fd8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa59f8:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x39d57:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x66777:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x92197:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x4674f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x7316f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x9eb8f:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x4654d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x72f6d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x9e98d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x45ff9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x72a19:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x9e439:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x4664f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x7306f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x9ea8f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x467c7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x731e7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9ec07:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x39922:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x66342:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x91d62:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x45214:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x71c34:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9d654:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x3a66a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x6708a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x92aaa:$sequence_7: 66 89 0C 02 5B 8B E5 5D
00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x48c51:$sqlite3step: 68 34 1C 7B E1 0x48d84:$sqlite3step: 68 34 1C 7B E1 0x75671:$sqlite3step: 68 34 1C 7B E1 0x757a4:$sqlite3step: 68 34 1C 7B E1 0xa1091:$sqlite3step: 68 34 1C 7B E1 0xa11c4:$sqlite3step: 68 34 1C 7B E1 0x48c93:$sqlite3text: 68 38 2A 90 C5 0x48ddb:$sqlite3text: 68 38 2A 90 C5 0x756b3:$sqlite3text: 68 38 2A 90 C5 0x757fb:$sqlite3text: 68 38 2A 90 C5 0xa10d3:$sqlite3text: 68 38 2A 90 C5 0xa121b:$sqlite3text: 68 38 2A 90 C5 0x48caa:$sqlite3blob: 68 53 D8 7F 8C 0x48dfd:$sqlite3blob: 68 53 D8 7F 8C 0x756ca:$sqlite3blob: 68 53 D8 7F 8C 0x7581d:$sqlite3blob: 68 53 D8 7F 8C 0xa10ea:$sqlite3blob: 68 53 D8 7F 8C 0xa123d:$sqlite3blob: 68 53 D8 7F 8C
0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xe160:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x72f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x70f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x6ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x71f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x736f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x5dbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xcdb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xdeca:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x97f9:$sqlite3step: 68 34 1C 7B E1 0x992c:$sqlite3step: 68 34 1C 7B E1 0x983b:$sqlite3text: 68 38 2A 90 C5 0x9983:$sqlite3text: 68 38 2A 90 C5 0x9852:$sqlite3blob: 68 53 D8 7F 8C 0x99a5:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xe160:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x72f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x70f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x6ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x71f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x736f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x5dbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xcdb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xdeca:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x97f9:$sqlite3step: 68 34 1C 7B E1 0x992c:$sqlite3step: 68 34 1C 7B E1 0x983b:$sqlite3text: 68 38 2A 90 C5 0x9983:$sqlite3text: 68 38 2A 90 C5 0x9852:$sqlite3blob: 68 53 D8 7F 8C 0x99a5:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x400b0:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 1888	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xe24:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: cmd.exe PID: 2896	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xae9:$a1: 3C 30 50 4F 53 54 74 09 40 0x46050:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x57e1:$a1: 3C 30 50 4F 53 54 74 09 40 0x1d360:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9aff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x164f7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x162f5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15da1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x163f7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1656f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x96ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14fbc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa412:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1bfb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d0ca:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x189f9:$sqlite3step: 68 34 1C 7B E1 0x18b2c:$sqlite3step: 68 34 1C 7B E1 0x18a3b:$sqlite3text: 68 38 2A 90 C5 0x18b83:$sqlite3text: 68 38 2A 90 C5 0x18a52:$sqlite3blob: 68 53 D8 7F 8C 0x18ba5:$sqlite3blob: 68 53 D8 7F 8C
0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x34e01:$a1: 3C 30 50 4F 53 54 74 09 40 0x61821:$a1: 3C 30 50 4F 53 54 74 09 40 0x8d241:$a1: 3C 30 50 4F 53 54 74 09 40 0x4c980:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x793a0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa4dc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x3911f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x65b3f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x9155f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x45b17:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x72537:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x9df57:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x45915:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x72335:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x9dd55:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x453c1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x71de1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x9d801:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x45a17:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x72437:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x9de57:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x45b8f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x725af:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x9dfcf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x38cea:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x6570a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x9112a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x445dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x70ffc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9ca1c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x39a32:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x66452:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x91e72:$sequence_7: 66 89 0C 02 5B 8B E5 5D
0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x48019:$sqlite3step: 68 34 1C 7B E1 0x4814c:$sqlite3step: 68 34 1C 7B E1 0x74a39:$sqlite3step: 68 34 1C 7B E1 0x74b6c:$sqlite3step: 68 34 1C 7B E1 0xa0459:$sqlite3step: 68 34 1C 7B E1 0xa058c:$sqlite3step: 68 34 1C 7B E1 0x4805b:$sqlite3text: 68 38 2A 90 C5 0x481a3:$sqlite3text: 68 38 2A 90 C5 0x74a7b:$sqlite3text: 68 38 2A 90 C5 0x74bc3:$sqlite3text: 68 38 2A 90 C5 0xa049b:$sqlite3text: 68 38 2A 90 C5 0xa05e3:$sqlite3text: 68 38 2A 90 C5 0x48072:$sqlite3blob: 68 53 D8 7F 8C 0x481c5:$sqlite3blob: 68 53 D8 7F 8C 0x74a92:$sqlite3blob: 68 53 D8 7F 8C 0x74be5:$sqlite3blob: 68 53 D8 7F 8C 0xa04b2:$sqlite3blob: 68 53 D8 7F 8C 0xa0605:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe	Virustotal: Detection: 38%			Perma Link
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe	ReversingLabs: Detection: 29%

Yara detected FormBook

Source: Yara match	File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: www.familism.net/qaom/

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe

ReversingLabs: Detection: 29%

Machine Learning detection for sample

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe

Joe Sandbox ML: detected

Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.familism.net/qaom/"], "decoy": ["WK4227sGKNxdtoj/0el0mSq6", "6xaJ/eBRc1Is34jYrt3HpbWWpL8=", "Q7+YyiJbcxwKABQO", "atnlwk5WXUDP", "O6yJJQ1+qofZlXOe9Tg=", "dunCiWrF4HybTdg=", "DMu9XSig1sDHpEurphKPD5I=", "0BiFGyxxBqHK9SoX", "I1T3Eo/xM+g+G8E=", "YNCVL0Gu1nybTdg=", "LK5/JglqrJNlLXsB/y8=", "GVT1r5DUEwmfRB49hQ==", "3FgVMp31AavK9SoX", "/Go/U5XV/73NRGaYz9Hj", "X5wxX+xch3fK9SoX", "7zegS4KNMpAEV88=", "6h6gMwpSYEpXCpjLqhKPD5I=", "gvSwORhos596Mc0rToo1E8p73E0xBu0BkA==", "siwQw91WgGlzSOpKMzztMvABuFg1", "Z6dAwcEocHDK9SoX", "h7Mox9lUflw78oXFrhKPD5I=", "xRSnRy6SEr9VuQ==", "d/zWB58BGMsb4xZo2gP6", "vyfkgl2Xv6k2o+IXStjUFiSiAg==", "crBR7fNVZk/nYJClIoVlzw==", "HGIDmKrWFPo=", "DI1Q7AExpQRXONI=", "/388PtNIZxpxZ/cdmFFAxw==", "5VYiHn7Y8eF43fj8L9rVFiSiAg==", "9UO3sVqQsmLF", "sXNmwsknc2xVO/RcUdHKE6fQJZm3zw==", "X9SLfeVhiWxQRB49hQ==", "j7wwN4PJAqBNr8tn+a4Aeuyt", "DE/Zg2Sr23ybTdg=", "WsyC+M8HJtukVniYIoVlzw==", "/jzqGSaiEr9VuQ==", "xSwSx8sWcl+0RB49hQ==", "qrSdt0jBEwgbg3sB/y8=", "zhiQnTF+5INt3woO", "+CK93DWQm0fDrPkh1xKPD5I=", "pOBXfOMlTw0Pd7LVml1ibSiz", "GItvoylqfzY/K4CiIoVlzw==", "/Ww8XPNtlk+qXmRHqaB0mSq6", "Uch4GPdKVzshf3sB/y8=", "zPNua9dQbiB0Vwpt7Pn4wEoTJBU9", "HZtax4/e8dM57w8bojTVvkwTJBU9", "uTlOCbAIUnBZUbsO0xKPD5I=", "XqUSspnoLSUlBHMQETY=", "rSTV4D+7Er9VuQ==", "bd3oTDOnF3ybTdg=", "pyDqCl2xul22qvLoVuGBZueCJZm3zw==", "deyiDdEUUTUaqVezL857jZ97lDP8xw==", "syQDtrscLQ2kRB49hQ==", "KlzKRxhUdxUtj9khEX3IjYLEw+Qb5X0=", "l9NbxqQUPC8vBnMQETY=", "LaiNxSxCizujRB49hQ==", "QLiHqfxYm1kshbv853KG87WWpL8=", "kOp/JDkY0qwjrg==", "GdW4A7HsB3ybTdg=", "QbqiVFmfl0Ma5Slgnh3WHeyBJZm3zw==", "DY45YM89dV+1RB49hQ==", "aqkyAuctVzMO5X3DqxKPD5I=", "WoDzipz+PStyOtgA", "lQraDqf9JQnmr/fnLin2qSey"]}

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop edi		21_2_005D8910
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop edi		21_2_005D890F

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.familism.net/qaom/

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236947938.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://en.wi
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239517946.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239379153.00000000060B2000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237645977.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237561745.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237607822.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237418195.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237253717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237348551.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237394542.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237371268.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comEach4
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comz
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241315732.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.250073464.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241188909.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241339444.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241553390.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241401813.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241449552.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersd
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241302162.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designerse1
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241302162.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersl
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designerss
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comE.TTF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244037027.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243761000.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244069272.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243727765.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244008649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243982106.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243789684.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243930754.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241226152.00000000060D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comN?:
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241622575.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243633570.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalsd7
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242188590.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242263259.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd7
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdQ
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241622575.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdnF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241860717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessedG?1
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comgrito
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243633570.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comicTFf
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comltvoN?:
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241860717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241315732.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241401813.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241562151.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241449552.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241226152.00000000060D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comrsiv
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242552714.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comtoTF
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242188590.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242263259.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comtu
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236573699.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.c
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn6
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnZ
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnb-n
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnr
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244725982.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244841654.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245162197.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245031662.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245128766.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244923054.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244954693.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244725982.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244968212.00000000060D8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245288432.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247776276.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246780981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245690952.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247331002.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247062279.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246315588.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245384768.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.250073464.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247030819.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245313604.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245752027.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247266835.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246402353.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/%
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239849647.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240076436.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240030862.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240708870.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239999372.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240479501.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239966190.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240758246.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240663615.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240527492.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239773487.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239745515.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240437508.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239942847.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-s
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239849647.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240076436.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240030862.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239999372.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239966190.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239773487.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239745515.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239942847.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/f
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238369385.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/lnlN?:
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/xN
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn2
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnlg?

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.279048844.000000000155B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 1888, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: cmd.exe PID: 2896, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 1888, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: cmd.exe PID: 2896, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 0_2_0150F250	0_2_0150F250
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 0_2_0150F240	0_2_0150F240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 0_2_0150D2AC	0_2_0150D2AC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01744120	8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172F900	8_2_0172F900
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A830	8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017FE824	8_2_017FE824
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1002	8_2_017E1002
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F28EC	8_2_017F28EC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017520A0	8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F20A8	8_2_017F20A8
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173B090	8_2_0173B090
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174AB40	8_2_0174AB40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F2B28	8_2_017F2B28
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E03DA	8_2_017E03DA
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EDBD2	8_2_017EDBD2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175EBB0	8_2_0175EBB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017DFA2B	8_2_017DFA2B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F22AE	8_2_017F22AE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F1D55	8_2_017F1D55
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01720D20	8_2_01720D20
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F2D07	8_2_017F2D07
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173D5E0	8_2_0173D5E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F25DD	8_2_017F25DD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752581	8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017ED466	8_2_017ED466
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173841F	8_2_0173841F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F1FF1	8_2_017F1FF1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017FDFCE	8_2_017FDFCE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01746E30	8_2_01746E30
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017ED616	8_2_017ED616
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F2EF7	8_2_017F2EF7
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_00420395	8_2_00420395
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E2B28	21_2_032E2B28
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323AB40	21_2_0323AB40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324EBB0	21_2_0324EBB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D03DA	21_2_032D03DA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DDBD2	21_2_032DDBD2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032CFA2B	21_2_032CFA2B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E22AE	21_2_032E22AE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03234120	21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321F900	21_2_0321F900
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032EE824	21_2_032EE824
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A830	21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D1002	21_2_032D1002
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032420A0	21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E20A8	21_2_032E20A8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322B090	21_2_0322B090
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E28EC	21_2_032E28EC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E1FF1	21_2_032E1FF1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032EDFCE	21_2_032EDFCE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03236E30	21_2_03236E30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DD616	21_2_032DD616
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E2EF7	21_2_032E2EF7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03210D20	21_2_03210D20
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E2D07	21_2_032E2D07
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E1D55	21_2_032E1D55
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03242581	21_2_03242581
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322D5E0	21_2_0322D5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E25DD	21_2_032E25DD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322841F	21_2_0322841F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DD466	21_2_032DD466
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005D8910	21_2_005D8910
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005F001C	21_2_005F001C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005DE9D0	21_2_005DE9D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005F0395	21_2_005F0395
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005D9D90	21_2_005D9D90
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005D2D90	21_2_005D2D90
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005D2FB0	21_2_005D2FB0

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: String function: 0172B150 appears 54 times
Source: C:\Windows\SysWOW64\cmd.exe	Code function: String function: 0321B150 appears 72 times

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769910 NtAdjustPrivilegesToken,LdrInitializeThunk,	8_2_01769910
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017699A0 NtCreateSection,LdrInitializeThunk,	8_2_017699A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769860 NtQuerySystemInformation,LdrInitializeThunk,	8_2_01769860
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769840 NtDelayExecution,LdrInitializeThunk,	8_2_01769840
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017698F0 NtReadVirtualMemory,LdrInitializeThunk,	8_2_017698F0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769A50 NtCreateFile,LdrInitializeThunk,	8_2_01769A50
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769A20 NtResumeThread,LdrInitializeThunk,	8_2_01769A20
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769A00 NtProtectVirtualMemory,LdrInitializeThunk,	8_2_01769A00
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769540 NtReadFile,LdrInitializeThunk,	8_2_01769540
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017695D0 NtClose,LdrInitializeThunk,	8_2_017695D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769710 NtQueryInformationToken,LdrInitializeThunk,	8_2_01769710
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769FE0 NtCreateMutant,LdrInitializeThunk,	8_2_01769FE0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017697A0 NtUnmapViewOfSection,LdrInitializeThunk,	8_2_017697A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769780 NtMapViewOfSection,LdrInitializeThunk,	8_2_01769780
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769660 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_01769660
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017696E0 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_017696E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769950 NtQueueApcThread,	8_2_01769950
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017699D0 NtCreateProcessEx,	8_2_017699D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0176B040 NtSuspendThread,	8_2_0176B040
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769820 NtEnumerateKey,	8_2_01769820
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017698A0 NtWriteVirtualMemory,	8_2_017698A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769B00 NtSetValueKey,	8_2_01769B00
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0176A3B0 NtGetContextThread,	8_2_0176A3B0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769A10 NtQuerySection,	8_2_01769A10
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769A80 NtOpenDirectoryObject,	8_2_01769A80
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769560 NtWriteFile,	8_2_01769560
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0176AD30 NtSetContextThread,	8_2_0176AD30
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769520 NtWaitForSingleObject,	8_2_01769520
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017695F0 NtQueryInformationFile,	8_2_017695F0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0176A770 NtOpenThread,	8_2_0176A770
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769770 NtSetInformationFile,	8_2_01769770
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769760 NtOpenProcess,	8_2_01769760
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769730 NtQueryVirtualMemory,	8_2_01769730
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0176A710 NtOpenProcessToken,	8_2_0176A710
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769670 NtQueryInformationProcess,	8_2_01769670
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769650 NtQueryValueKey,	8_2_01769650
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01769610 NtEnumerateValueKey,	8_2_01769610
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017696D0 NtCreateKey,	8_2_017696D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259A50 NtCreateFile,LdrInitializeThunk,	21_2_03259A50
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259910 NtAdjustPrivilegesToken,LdrInitializeThunk,	21_2_03259910
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032599A0 NtCreateSection,LdrInitializeThunk,	21_2_032599A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259860 NtQuerySystemInformation,LdrInitializeThunk,	21_2_03259860
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259840 NtDelayExecution,LdrInitializeThunk,	21_2_03259840
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259710 NtQueryInformationToken,LdrInitializeThunk,	21_2_03259710
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259780 NtMapViewOfSection,LdrInitializeThunk,	21_2_03259780
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259FE0 NtCreateMutant,LdrInitializeThunk,	21_2_03259FE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032596E0 NtFreeVirtualMemory,LdrInitializeThunk,	21_2_032596E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032596D0 NtCreateKey,LdrInitializeThunk,	21_2_032596D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259540 NtReadFile,LdrInitializeThunk,	21_2_03259540
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032595D0 NtClose,LdrInitializeThunk,	21_2_032595D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259B00 NtSetValueKey,	21_2_03259B00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0325A3B0 NtGetContextThread,	21_2_0325A3B0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259A20 NtResumeThread,	21_2_03259A20
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259A00 NtProtectVirtualMemory,	21_2_03259A00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259A10 NtQuerySection,	21_2_03259A10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259A80 NtOpenDirectoryObject,	21_2_03259A80
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259950 NtQueueApcThread,	21_2_03259950
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032599D0 NtCreateProcessEx,	21_2_032599D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259820 NtEnumerateKey,	21_2_03259820
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0325B040 NtSuspendThread,	21_2_0325B040
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032598A0 NtWriteVirtualMemory,	21_2_032598A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032598F0 NtReadVirtualMemory,	21_2_032598F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259730 NtQueryVirtualMemory,	21_2_03259730
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0325A710 NtOpenProcessToken,	21_2_0325A710
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259760 NtOpenProcess,	21_2_03259760
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0325A770 NtOpenThread,	21_2_0325A770
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259770 NtSetInformationFile,	21_2_03259770
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032597A0 NtUnmapViewOfSection,	21_2_032597A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259610 NtEnumerateValueKey,	21_2_03259610
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259660 NtAllocateVirtualMemory,	21_2_03259660
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259670 NtQueryInformationProcess,	21_2_03259670
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259650 NtQueryValueKey,	21_2_03259650
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259520 NtWaitForSingleObject,	21_2_03259520
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0325AD30 NtSetContextThread,	21_2_0325AD30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03259560 NtWriteFile,	21_2_03259560
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032595F0 NtQueryInformationFile,	21_2_032595F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EB850 NtClose,	21_2_005EB850
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EB820 NtDeleteFile,	21_2_005EB820
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EB720 NtCreateFile,	21_2_005EB720
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EB7D0 NtReadFile,	21_2_005EB7D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EB81A NtDeleteFile,	21_2_005EB81A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EB71A NtCreateFile,	21_2_005EB71A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EB7CA NtReadFile,	21_2_005EB7CA

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.303696641.00000000077C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameKeysNormalize.dll4 vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDoncepre.dll@ vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.257169333.0000000007824000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSwitchValueSt.exeB vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.251729648.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKeysNormalize.dll4 vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000000.230772744.0000000000E06000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSwitchValueSt.exeB vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.304257285.00000000078F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameWebName.dll4 vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.279048844.000000000155B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.304726057.0000000007A70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDoncepre.dll@ vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.278766398.00000000014DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.282569146.0000000001689000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe	Binary or memory string: OriginalFilenameSwitchValueSt.exeB vs SwiftMessage_Unlocked_Transaction ProofMessage.exe

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Section loaded: onecoreuapcommonproxystub.dll

Jump to behavior

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wKwiksScXFp.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe	Virustotal: Detection: 38%
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe	ReversingLabs: Detection: 29%

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

File read: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Jump to behavior

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe "C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe"
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

File created: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe

Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

File created: C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/8@0/0

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Mutant created: \Sessions\1\BaseNamedObjects\rObCTeCTUwCXtLerA
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3404:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_01

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.276717039.00000000013C8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000003.280618742.000000000156A000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000015.00000003.429124075.0000000000EBE000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, cmd.exe, 00000015.00000003.427047954.0000000000D15000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0177D0D1 push ecx; ret	8_2_0177D0E4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_00420166 push 75DEC230h; ret	8_2_00420173
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0326D0D1 push ecx; ret	21_2_0326D0E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005F0166 push 75DEC230h; ret	21_2_005F0173
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005ED924 push edx; retf	21_2_005ED927
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EEA55 push eax; ret	21_2_005EEAA8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005E8273 push eax; retf	21_2_005E8274
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005E82F1 pushad ; ret	21_2_005E82F4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EEAAB push eax; ret	21_2_005EEB12
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EEAA2 push eax; ret	21_2_005EEAA8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005D6B10 pushfd ; retf	21_2_005D6BA2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EEB0C push eax; ret	21_2_005EEB12
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005EBB37 push 00000063h; retf	21_2_005EBB3A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005D6B8F pushfd ; retf	21_2_005D6BA2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005E7E79 push esp; retf	21_2_005E7E7A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_005DB724 push 19B8h; ret	21_2_005DB730

Source: initial sample	Static PE information: section name: .text entropy: 7.729603877475422
Source: initial sample	Static PE information: section name: .text entropy: 7.729603877475422

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

File created: C:\Users\user\AppData\Roaming\wKwiksScXFp.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SwiftMessage_Unlocked_Transaction ProofMessage.exe PID: 3144, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe TID: 1476	Thread sleep time: -45877s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe TID: 1100	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1796	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Code function: 8_2_017F5BA5 rdtsc

8_2_017F5BA5

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9243

Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	API coverage: 4.9 %
Source: C:\Windows\SysWOW64\cmd.exe	API coverage: 7.4 %

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Thread delayed: delay time: 45877	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: explorer.exe, 0000000B.00000000.376640838.00000000051AC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 0000000B.00000000.310708982.00000000051F7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}71USER
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000B.00000000.314310480.0000000005EAB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.310708982.00000000051F7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 0000000B.00000000.376537434.0000000005136000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000B.00000000.315581158.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00dRom0cY

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Code function: 8_2_017F5BA5 rdtsc

8_2_017F5BA5

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172B171 mov eax, dword ptr fs:[00000030h]	8_2_0172B171
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172B171 mov eax, dword ptr fs:[00000030h]	8_2_0172B171
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172C962 mov eax, dword ptr fs:[00000030h]	8_2_0172C962
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174B944 mov eax, dword ptr fs:[00000030h]	8_2_0174B944
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174B944 mov eax, dword ptr fs:[00000030h]	8_2_0174B944
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175513A mov eax, dword ptr fs:[00000030h]	8_2_0175513A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175513A mov eax, dword ptr fs:[00000030h]	8_2_0175513A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h]	8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h]	8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h]	8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01744120 mov eax, dword ptr fs:[00000030h]	8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01744120 mov ecx, dword ptr fs:[00000030h]	8_2_01744120
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729100 mov eax, dword ptr fs:[00000030h]	8_2_01729100
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729100 mov eax, dword ptr fs:[00000030h]	8_2_01729100
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729100 mov eax, dword ptr fs:[00000030h]	8_2_01729100
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017B41E8 mov eax, dword ptr fs:[00000030h]	8_2_017B41E8
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172B1E1 mov eax, dword ptr fs:[00000030h]	8_2_0172B1E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172B1E1 mov eax, dword ptr fs:[00000030h]	8_2_0172B1E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172B1E1 mov eax, dword ptr fs:[00000030h]	8_2_0172B1E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h]	8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h]	8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h]	8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A51BE mov eax, dword ptr fs:[00000030h]	8_2_017A51BE
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017561A0 mov eax, dword ptr fs:[00000030h]	8_2_017561A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017561A0 mov eax, dword ptr fs:[00000030h]	8_2_017561A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h]	8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h]	8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h]	8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E49A4 mov eax, dword ptr fs:[00000030h]	8_2_017E49A4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A69A6 mov eax, dword ptr fs:[00000030h]	8_2_017A69A6
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752990 mov eax, dword ptr fs:[00000030h]	8_2_01752990
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175A185 mov eax, dword ptr fs:[00000030h]	8_2_0175A185
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174C182 mov eax, dword ptr fs:[00000030h]	8_2_0174C182
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F1074 mov eax, dword ptr fs:[00000030h]	8_2_017F1074
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E2073 mov eax, dword ptr fs:[00000030h]	8_2_017E2073
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01740050 mov eax, dword ptr fs:[00000030h]	8_2_01740050
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01740050 mov eax, dword ptr fs:[00000030h]	8_2_01740050
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h]	8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h]	8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h]	8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A830 mov eax, dword ptr fs:[00000030h]	8_2_0174A830
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h]	8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h]	8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h]	8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h]	8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175002D mov eax, dword ptr fs:[00000030h]	8_2_0175002D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h]	8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h]	8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h]	8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173B02A mov eax, dword ptr fs:[00000030h]	8_2_0173B02A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F4015 mov eax, dword ptr fs:[00000030h]	8_2_017F4015
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F4015 mov eax, dword ptr fs:[00000030h]	8_2_017F4015
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A7016 mov eax, dword ptr fs:[00000030h]	8_2_017A7016
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A7016 mov eax, dword ptr fs:[00000030h]	8_2_017A7016
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A7016 mov eax, dword ptr fs:[00000030h]	8_2_017A7016
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017240E1 mov eax, dword ptr fs:[00000030h]	8_2_017240E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017240E1 mov eax, dword ptr fs:[00000030h]	8_2_017240E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017240E1 mov eax, dword ptr fs:[00000030h]	8_2_017240E1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017258EC mov eax, dword ptr fs:[00000030h]	8_2_017258EC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h]	8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BB8D0 mov ecx, dword ptr fs:[00000030h]	8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h]	8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h]	8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h]	8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BB8D0 mov eax, dword ptr fs:[00000030h]	8_2_017BB8D0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175F0BF mov ecx, dword ptr fs:[00000030h]	8_2_0175F0BF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175F0BF mov eax, dword ptr fs:[00000030h]	8_2_0175F0BF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175F0BF mov eax, dword ptr fs:[00000030h]	8_2_0175F0BF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h]	8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h]	8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h]	8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h]	8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h]	8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017520A0 mov eax, dword ptr fs:[00000030h]	8_2_017520A0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017690AF mov eax, dword ptr fs:[00000030h]	8_2_017690AF
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729080 mov eax, dword ptr fs:[00000030h]	8_2_01729080
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A3884 mov eax, dword ptr fs:[00000030h]	8_2_017A3884
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A3884 mov eax, dword ptr fs:[00000030h]	8_2_017A3884
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01753B7A mov eax, dword ptr fs:[00000030h]	8_2_01753B7A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01753B7A mov eax, dword ptr fs:[00000030h]	8_2_01753B7A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172DB60 mov ecx, dword ptr fs:[00000030h]	8_2_0172DB60
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F8B58 mov eax, dword ptr fs:[00000030h]	8_2_017F8B58
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172F358 mov eax, dword ptr fs:[00000030h]	8_2_0172F358
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172DB40 mov eax, dword ptr fs:[00000030h]	8_2_0172DB40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E131B mov eax, dword ptr fs:[00000030h]	8_2_017E131B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h]	8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h]	8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h]	8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h]	8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h]	8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017503E2 mov eax, dword ptr fs:[00000030h]	8_2_017503E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174DBE9 mov eax, dword ptr fs:[00000030h]	8_2_0174DBE9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A53CA mov eax, dword ptr fs:[00000030h]	8_2_017A53CA
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A53CA mov eax, dword ptr fs:[00000030h]	8_2_017A53CA
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01754BAD mov eax, dword ptr fs:[00000030h]	8_2_01754BAD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01754BAD mov eax, dword ptr fs:[00000030h]	8_2_01754BAD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01754BAD mov eax, dword ptr fs:[00000030h]	8_2_01754BAD
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F5BA5 mov eax, dword ptr fs:[00000030h]	8_2_017F5BA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752397 mov eax, dword ptr fs:[00000030h]	8_2_01752397
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175B390 mov eax, dword ptr fs:[00000030h]	8_2_0175B390
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E138A mov eax, dword ptr fs:[00000030h]	8_2_017E138A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01731B8F mov eax, dword ptr fs:[00000030h]	8_2_01731B8F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01731B8F mov eax, dword ptr fs:[00000030h]	8_2_01731B8F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017DD380 mov ecx, dword ptr fs:[00000030h]	8_2_017DD380
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0176927A mov eax, dword ptr fs:[00000030h]	8_2_0176927A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017DB260 mov eax, dword ptr fs:[00000030h]	8_2_017DB260
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017DB260 mov eax, dword ptr fs:[00000030h]	8_2_017DB260
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F8A62 mov eax, dword ptr fs:[00000030h]	8_2_017F8A62
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EEA55 mov eax, dword ptr fs:[00000030h]	8_2_017EEA55
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017B4257 mov eax, dword ptr fs:[00000030h]	8_2_017B4257
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h]	8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h]	8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h]	8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01729240 mov eax, dword ptr fs:[00000030h]	8_2_01729240
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01764A2C mov eax, dword ptr fs:[00000030h]	8_2_01764A2C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01764A2C mov eax, dword ptr fs:[00000030h]	8_2_01764A2C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174A229 mov eax, dword ptr fs:[00000030h]	8_2_0174A229
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01725210 mov eax, dword ptr fs:[00000030h]	8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01725210 mov ecx, dword ptr fs:[00000030h]	8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01725210 mov eax, dword ptr fs:[00000030h]	8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01725210 mov eax, dword ptr fs:[00000030h]	8_2_01725210
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172AA16 mov eax, dword ptr fs:[00000030h]	8_2_0172AA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172AA16 mov eax, dword ptr fs:[00000030h]	8_2_0172AA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01743A1C mov eax, dword ptr fs:[00000030h]	8_2_01743A1C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EAA16 mov eax, dword ptr fs:[00000030h]	8_2_017EAA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EAA16 mov eax, dword ptr fs:[00000030h]	8_2_017EAA16
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01738A0A mov eax, dword ptr fs:[00000030h]	8_2_01738A0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752AE4 mov eax, dword ptr fs:[00000030h]	8_2_01752AE4
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752ACB mov eax, dword ptr fs:[00000030h]	8_2_01752ACB
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173AAB0 mov eax, dword ptr fs:[00000030h]	8_2_0173AAB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173AAB0 mov eax, dword ptr fs:[00000030h]	8_2_0173AAB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175FAB0 mov eax, dword ptr fs:[00000030h]	8_2_0175FAB0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h]	8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h]	8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h]	8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h]	8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017252A5 mov eax, dword ptr fs:[00000030h]	8_2_017252A5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175D294 mov eax, dword ptr fs:[00000030h]	8_2_0175D294
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175D294 mov eax, dword ptr fs:[00000030h]	8_2_0175D294
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174C577 mov eax, dword ptr fs:[00000030h]	8_2_0174C577
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174C577 mov eax, dword ptr fs:[00000030h]	8_2_0174C577
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01747D50 mov eax, dword ptr fs:[00000030h]	8_2_01747D50
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01763D43 mov eax, dword ptr fs:[00000030h]	8_2_01763D43
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A3540 mov eax, dword ptr fs:[00000030h]	8_2_017A3540
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017D3D40 mov eax, dword ptr fs:[00000030h]	8_2_017D3D40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172AD30 mov eax, dword ptr fs:[00000030h]	8_2_0172AD30
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01733D34 mov eax, dword ptr fs:[00000030h]	8_2_01733D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EE539 mov eax, dword ptr fs:[00000030h]	8_2_017EE539
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F8D34 mov eax, dword ptr fs:[00000030h]	8_2_017F8D34
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017AA537 mov eax, dword ptr fs:[00000030h]	8_2_017AA537
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01754D3B mov eax, dword ptr fs:[00000030h]	8_2_01754D3B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01754D3B mov eax, dword ptr fs:[00000030h]	8_2_01754D3B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01754D3B mov eax, dword ptr fs:[00000030h]	8_2_01754D3B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017D8DF1 mov eax, dword ptr fs:[00000030h]	8_2_017D8DF1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173D5E0 mov eax, dword ptr fs:[00000030h]	8_2_0173D5E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173D5E0 mov eax, dword ptr fs:[00000030h]	8_2_0173D5E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h]	8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h]	8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h]	8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EFDE2 mov eax, dword ptr fs:[00000030h]	8_2_017EFDE2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h]	8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h]	8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h]	8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6DC9 mov ecx, dword ptr fs:[00000030h]	8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h]	8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6DC9 mov eax, dword ptr fs:[00000030h]	8_2_017A6DC9
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01751DB5 mov eax, dword ptr fs:[00000030h]	8_2_01751DB5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01751DB5 mov eax, dword ptr fs:[00000030h]	8_2_01751DB5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01751DB5 mov eax, dword ptr fs:[00000030h]	8_2_01751DB5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F05AC mov eax, dword ptr fs:[00000030h]	8_2_017F05AC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F05AC mov eax, dword ptr fs:[00000030h]	8_2_017F05AC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017535A1 mov eax, dword ptr fs:[00000030h]	8_2_017535A1
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175FD9B mov eax, dword ptr fs:[00000030h]	8_2_0175FD9B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175FD9B mov eax, dword ptr fs:[00000030h]	8_2_0175FD9B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h]	8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h]	8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h]	8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01752581 mov eax, dword ptr fs:[00000030h]	8_2_01752581
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h]	8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h]	8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h]	8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h]	8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01722D8A mov eax, dword ptr fs:[00000030h]	8_2_01722D8A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174746D mov eax, dword ptr fs:[00000030h]	8_2_0174746D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BC450 mov eax, dword ptr fs:[00000030h]	8_2_017BC450
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BC450 mov eax, dword ptr fs:[00000030h]	8_2_017BC450
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175A44B mov eax, dword ptr fs:[00000030h]	8_2_0175A44B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175BC2C mov eax, dword ptr fs:[00000030h]	8_2_0175BC2C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h]	8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h]	8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h]	8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6C0A mov eax, dword ptr fs:[00000030h]	8_2_017A6C0A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F740D mov eax, dword ptr fs:[00000030h]	8_2_017F740D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F740D mov eax, dword ptr fs:[00000030h]	8_2_017F740D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F740D mov eax, dword ptr fs:[00000030h]	8_2_017F740D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1C06 mov eax, dword ptr fs:[00000030h]	8_2_017E1C06
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E14FB mov eax, dword ptr fs:[00000030h]	8_2_017E14FB
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6CF0 mov eax, dword ptr fs:[00000030h]	8_2_017A6CF0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6CF0 mov eax, dword ptr fs:[00000030h]	8_2_017A6CF0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A6CF0 mov eax, dword ptr fs:[00000030h]	8_2_017A6CF0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F8CD6 mov eax, dword ptr fs:[00000030h]	8_2_017F8CD6
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173849B mov eax, dword ptr fs:[00000030h]	8_2_0173849B
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173FF60 mov eax, dword ptr fs:[00000030h]	8_2_0173FF60
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F8F6A mov eax, dword ptr fs:[00000030h]	8_2_017F8F6A
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173EF40 mov eax, dword ptr fs:[00000030h]	8_2_0173EF40
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175E730 mov eax, dword ptr fs:[00000030h]	8_2_0175E730
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01724F2E mov eax, dword ptr fs:[00000030h]	8_2_01724F2E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01724F2E mov eax, dword ptr fs:[00000030h]	8_2_01724F2E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174F716 mov eax, dword ptr fs:[00000030h]	8_2_0174F716
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BFF10 mov eax, dword ptr fs:[00000030h]	8_2_017BFF10
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BFF10 mov eax, dword ptr fs:[00000030h]	8_2_017BFF10
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F070D mov eax, dword ptr fs:[00000030h]	8_2_017F070D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F070D mov eax, dword ptr fs:[00000030h]	8_2_017F070D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175A70E mov eax, dword ptr fs:[00000030h]	8_2_0175A70E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175A70E mov eax, dword ptr fs:[00000030h]	8_2_0175A70E
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017637F5 mov eax, dword ptr fs:[00000030h]	8_2_017637F5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01738794 mov eax, dword ptr fs:[00000030h]	8_2_01738794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A7794 mov eax, dword ptr fs:[00000030h]	8_2_017A7794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A7794 mov eax, dword ptr fs:[00000030h]	8_2_017A7794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A7794 mov eax, dword ptr fs:[00000030h]	8_2_017A7794
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h]	8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h]	8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h]	8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h]	8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0174AE73 mov eax, dword ptr fs:[00000030h]	8_2_0174AE73
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0173766D mov eax, dword ptr fs:[00000030h]	8_2_0173766D
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h]	8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h]	8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h]	8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h]	8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h]	8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01737E41 mov eax, dword ptr fs:[00000030h]	8_2_01737E41
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EAE44 mov eax, dword ptr fs:[00000030h]	8_2_017EAE44
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017EAE44 mov eax, dword ptr fs:[00000030h]	8_2_017EAE44
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017DFE3F mov eax, dword ptr fs:[00000030h]	8_2_017DFE3F
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172E620 mov eax, dword ptr fs:[00000030h]	8_2_0172E620
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175A61C mov eax, dword ptr fs:[00000030h]	8_2_0175A61C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0175A61C mov eax, dword ptr fs:[00000030h]	8_2_0175A61C
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172C600 mov eax, dword ptr fs:[00000030h]	8_2_0172C600
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172C600 mov eax, dword ptr fs:[00000030h]	8_2_0172C600
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_0172C600 mov eax, dword ptr fs:[00000030h]	8_2_0172C600
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01758E00 mov eax, dword ptr fs:[00000030h]	8_2_01758E00
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017E1608 mov eax, dword ptr fs:[00000030h]	8_2_017E1608
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017376E2 mov eax, dword ptr fs:[00000030h]	8_2_017376E2
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017516E0 mov ecx, dword ptr fs:[00000030h]	8_2_017516E0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F8ED6 mov eax, dword ptr fs:[00000030h]	8_2_017F8ED6
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_01768EC7 mov eax, dword ptr fs:[00000030h]	8_2_01768EC7
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017536CC mov eax, dword ptr fs:[00000030h]	8_2_017536CC
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017DFEC0 mov eax, dword ptr fs:[00000030h]	8_2_017DFEC0
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F0EA5 mov eax, dword ptr fs:[00000030h]	8_2_017F0EA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F0EA5 mov eax, dword ptr fs:[00000030h]	8_2_017F0EA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017F0EA5 mov eax, dword ptr fs:[00000030h]	8_2_017F0EA5
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017A46A7 mov eax, dword ptr fs:[00000030h]	8_2_017A46A7
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Code function: 8_2_017BFE87 mov eax, dword ptr fs:[00000030h]	8_2_017BFE87
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D131B mov eax, dword ptr fs:[00000030h]	21_2_032D131B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321DB60 mov ecx, dword ptr fs:[00000030h]	21_2_0321DB60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03243B7A mov eax, dword ptr fs:[00000030h]	21_2_03243B7A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03243B7A mov eax, dword ptr fs:[00000030h]	21_2_03243B7A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321DB40 mov eax, dword ptr fs:[00000030h]	21_2_0321DB40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E8B58 mov eax, dword ptr fs:[00000030h]	21_2_032E8B58
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321F358 mov eax, dword ptr fs:[00000030h]	21_2_0321F358
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03244BAD mov eax, dword ptr fs:[00000030h]	21_2_03244BAD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03244BAD mov eax, dword ptr fs:[00000030h]	21_2_03244BAD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03244BAD mov eax, dword ptr fs:[00000030h]	21_2_03244BAD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E5BA5 mov eax, dword ptr fs:[00000030h]	21_2_032E5BA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D138A mov eax, dword ptr fs:[00000030h]	21_2_032D138A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032CD380 mov ecx, dword ptr fs:[00000030h]	21_2_032CD380
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03221B8F mov eax, dword ptr fs:[00000030h]	21_2_03221B8F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03221B8F mov eax, dword ptr fs:[00000030h]	21_2_03221B8F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03242397 mov eax, dword ptr fs:[00000030h]	21_2_03242397
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324B390 mov eax, dword ptr fs:[00000030h]	21_2_0324B390
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h]	21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h]	21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h]	21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h]	21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h]	21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032403E2 mov eax, dword ptr fs:[00000030h]	21_2_032403E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323DBE9 mov eax, dword ptr fs:[00000030h]	21_2_0323DBE9
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032953CA mov eax, dword ptr fs:[00000030h]	21_2_032953CA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032953CA mov eax, dword ptr fs:[00000030h]	21_2_032953CA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03254A2C mov eax, dword ptr fs:[00000030h]	21_2_03254A2C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03254A2C mov eax, dword ptr fs:[00000030h]	21_2_03254A2C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A229 mov eax, dword ptr fs:[00000030h]	21_2_0323A229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03228A0A mov eax, dword ptr fs:[00000030h]	21_2_03228A0A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03215210 mov eax, dword ptr fs:[00000030h]	21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03215210 mov ecx, dword ptr fs:[00000030h]	21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03215210 mov eax, dword ptr fs:[00000030h]	21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03215210 mov eax, dword ptr fs:[00000030h]	21_2_03215210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321AA16 mov eax, dword ptr fs:[00000030h]	21_2_0321AA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321AA16 mov eax, dword ptr fs:[00000030h]	21_2_0321AA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DAA16 mov eax, dword ptr fs:[00000030h]	21_2_032DAA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DAA16 mov eax, dword ptr fs:[00000030h]	21_2_032DAA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03233A1C mov eax, dword ptr fs:[00000030h]	21_2_03233A1C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032CB260 mov eax, dword ptr fs:[00000030h]	21_2_032CB260
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032CB260 mov eax, dword ptr fs:[00000030h]	21_2_032CB260
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E8A62 mov eax, dword ptr fs:[00000030h]	21_2_032E8A62
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0325927A mov eax, dword ptr fs:[00000030h]	21_2_0325927A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h]	21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h]	21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h]	21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219240 mov eax, dword ptr fs:[00000030h]	21_2_03219240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DEA55 mov eax, dword ptr fs:[00000030h]	21_2_032DEA55
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032A4257 mov eax, dword ptr fs:[00000030h]	21_2_032A4257
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h]	21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h]	21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h]	21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h]	21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032152A5 mov eax, dword ptr fs:[00000030h]	21_2_032152A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322AAB0 mov eax, dword ptr fs:[00000030h]	21_2_0322AAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322AAB0 mov eax, dword ptr fs:[00000030h]	21_2_0322AAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324FAB0 mov eax, dword ptr fs:[00000030h]	21_2_0324FAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324D294 mov eax, dword ptr fs:[00000030h]	21_2_0324D294
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324D294 mov eax, dword ptr fs:[00000030h]	21_2_0324D294
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03242AE4 mov eax, dword ptr fs:[00000030h]	21_2_03242AE4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03242ACB mov eax, dword ptr fs:[00000030h]	21_2_03242ACB
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h]	21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h]	21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h]	21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03234120 mov eax, dword ptr fs:[00000030h]	21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03234120 mov ecx, dword ptr fs:[00000030h]	21_2_03234120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324513A mov eax, dword ptr fs:[00000030h]	21_2_0324513A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324513A mov eax, dword ptr fs:[00000030h]	21_2_0324513A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219100 mov eax, dword ptr fs:[00000030h]	21_2_03219100
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219100 mov eax, dword ptr fs:[00000030h]	21_2_03219100
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219100 mov eax, dword ptr fs:[00000030h]	21_2_03219100
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321C962 mov eax, dword ptr fs:[00000030h]	21_2_0321C962
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321B171 mov eax, dword ptr fs:[00000030h]	21_2_0321B171
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321B171 mov eax, dword ptr fs:[00000030h]	21_2_0321B171
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323B944 mov eax, dword ptr fs:[00000030h]	21_2_0323B944
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323B944 mov eax, dword ptr fs:[00000030h]	21_2_0323B944
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032461A0 mov eax, dword ptr fs:[00000030h]	21_2_032461A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032461A0 mov eax, dword ptr fs:[00000030h]	21_2_032461A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h]	21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h]	21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h]	21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D49A4 mov eax, dword ptr fs:[00000030h]	21_2_032D49A4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032969A6 mov eax, dword ptr fs:[00000030h]	21_2_032969A6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h]	21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h]	21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h]	21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032951BE mov eax, dword ptr fs:[00000030h]	21_2_032951BE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov ecx, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032399BF mov eax, dword ptr fs:[00000030h]	21_2_032399BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323C182 mov eax, dword ptr fs:[00000030h]	21_2_0323C182
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324A185 mov eax, dword ptr fs:[00000030h]	21_2_0324A185
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03242990 mov eax, dword ptr fs:[00000030h]	21_2_03242990
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321B1E1 mov eax, dword ptr fs:[00000030h]	21_2_0321B1E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321B1E1 mov eax, dword ptr fs:[00000030h]	21_2_0321B1E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321B1E1 mov eax, dword ptr fs:[00000030h]	21_2_0321B1E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032A41E8 mov eax, dword ptr fs:[00000030h]	21_2_032A41E8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h]	21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h]	21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h]	21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322B02A mov eax, dword ptr fs:[00000030h]	21_2_0322B02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h]	21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h]	21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h]	21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h]	21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324002D mov eax, dword ptr fs:[00000030h]	21_2_0324002D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h]	21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h]	21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h]	21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323A830 mov eax, dword ptr fs:[00000030h]	21_2_0323A830
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E4015 mov eax, dword ptr fs:[00000030h]	21_2_032E4015
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E4015 mov eax, dword ptr fs:[00000030h]	21_2_032E4015
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03297016 mov eax, dword ptr fs:[00000030h]	21_2_03297016
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03297016 mov eax, dword ptr fs:[00000030h]	21_2_03297016
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03297016 mov eax, dword ptr fs:[00000030h]	21_2_03297016
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E1074 mov eax, dword ptr fs:[00000030h]	21_2_032E1074
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D2073 mov eax, dword ptr fs:[00000030h]	21_2_032D2073
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03230050 mov eax, dword ptr fs:[00000030h]	21_2_03230050
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03230050 mov eax, dword ptr fs:[00000030h]	21_2_03230050
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h]	21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h]	21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h]	21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h]	21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h]	21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032420A0 mov eax, dword ptr fs:[00000030h]	21_2_032420A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032590AF mov eax, dword ptr fs:[00000030h]	21_2_032590AF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324F0BF mov ecx, dword ptr fs:[00000030h]	21_2_0324F0BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324F0BF mov eax, dword ptr fs:[00000030h]	21_2_0324F0BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324F0BF mov eax, dword ptr fs:[00000030h]	21_2_0324F0BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03219080 mov eax, dword ptr fs:[00000030h]	21_2_03219080
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03293884 mov eax, dword ptr fs:[00000030h]	21_2_03293884
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03293884 mov eax, dword ptr fs:[00000030h]	21_2_03293884
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032140E1 mov eax, dword ptr fs:[00000030h]	21_2_032140E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032140E1 mov eax, dword ptr fs:[00000030h]	21_2_032140E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032140E1 mov eax, dword ptr fs:[00000030h]	21_2_032140E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323B8E4 mov eax, dword ptr fs:[00000030h]	21_2_0323B8E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323B8E4 mov eax, dword ptr fs:[00000030h]	21_2_0323B8E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032158EC mov eax, dword ptr fs:[00000030h]	21_2_032158EC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h]	21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AB8D0 mov ecx, dword ptr fs:[00000030h]	21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h]	21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h]	21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h]	21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AB8D0 mov eax, dword ptr fs:[00000030h]	21_2_032AB8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03214F2E mov eax, dword ptr fs:[00000030h]	21_2_03214F2E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03214F2E mov eax, dword ptr fs:[00000030h]	21_2_03214F2E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324E730 mov eax, dword ptr fs:[00000030h]	21_2_0324E730
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323B73D mov eax, dword ptr fs:[00000030h]	21_2_0323B73D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323B73D mov eax, dword ptr fs:[00000030h]	21_2_0323B73D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E070D mov eax, dword ptr fs:[00000030h]	21_2_032E070D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E070D mov eax, dword ptr fs:[00000030h]	21_2_032E070D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324A70E mov eax, dword ptr fs:[00000030h]	21_2_0324A70E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324A70E mov eax, dword ptr fs:[00000030h]	21_2_0324A70E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323F716 mov eax, dword ptr fs:[00000030h]	21_2_0323F716
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AFF10 mov eax, dword ptr fs:[00000030h]	21_2_032AFF10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AFF10 mov eax, dword ptr fs:[00000030h]	21_2_032AFF10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322FF60 mov eax, dword ptr fs:[00000030h]	21_2_0322FF60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E8F6A mov eax, dword ptr fs:[00000030h]	21_2_032E8F6A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322EF40 mov eax, dword ptr fs:[00000030h]	21_2_0322EF40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03228794 mov eax, dword ptr fs:[00000030h]	21_2_03228794
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03297794 mov eax, dword ptr fs:[00000030h]	21_2_03297794
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03297794 mov eax, dword ptr fs:[00000030h]	21_2_03297794
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03297794 mov eax, dword ptr fs:[00000030h]	21_2_03297794
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032537F5 mov eax, dword ptr fs:[00000030h]	21_2_032537F5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321E620 mov eax, dword ptr fs:[00000030h]	21_2_0321E620
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032CFE3F mov eax, dword ptr fs:[00000030h]	21_2_032CFE3F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321C600 mov eax, dword ptr fs:[00000030h]	21_2_0321C600
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321C600 mov eax, dword ptr fs:[00000030h]	21_2_0321C600
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0321C600 mov eax, dword ptr fs:[00000030h]	21_2_0321C600
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03248E00 mov eax, dword ptr fs:[00000030h]	21_2_03248E00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032D1608 mov eax, dword ptr fs:[00000030h]	21_2_032D1608
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324A61C mov eax, dword ptr fs:[00000030h]	21_2_0324A61C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0324A61C mov eax, dword ptr fs:[00000030h]	21_2_0324A61C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0322766D mov eax, dword ptr fs:[00000030h]	21_2_0322766D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h]	21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h]	21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h]	21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h]	21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_0323AE73 mov eax, dword ptr fs:[00000030h]	21_2_0323AE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h]	21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h]	21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h]	21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h]	21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h]	21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03227E41 mov eax, dword ptr fs:[00000030h]	21_2_03227E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DAE44 mov eax, dword ptr fs:[00000030h]	21_2_032DAE44
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032DAE44 mov eax, dword ptr fs:[00000030h]	21_2_032DAE44
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E0EA5 mov eax, dword ptr fs:[00000030h]	21_2_032E0EA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E0EA5 mov eax, dword ptr fs:[00000030h]	21_2_032E0EA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032E0EA5 mov eax, dword ptr fs:[00000030h]	21_2_032E0EA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032946A7 mov eax, dword ptr fs:[00000030h]	21_2_032946A7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032AFE87 mov eax, dword ptr fs:[00000030h]	21_2_032AFE87
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032276E2 mov eax, dword ptr fs:[00000030h]	21_2_032276E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032416E0 mov ecx, dword ptr fs:[00000030h]	21_2_032416E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_03258EC7 mov eax, dword ptr fs:[00000030h]	21_2_03258EC7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 21_2_032436CC mov eax, dword ptr fs:[00000030h]	21_2_032436CC

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Code function: 8_2_01769910 NtAdjustPrivilegesToken,LdrInitializeThunk,

8_2_01769910

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: 1190000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: unknown protection: read write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Thread register set: target process: 3616	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Thread register set: target process: 3616	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Thread register set: target process: 3616	Jump to behavior

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe			Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Process created: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Jump to behavior

Source: explorer.exe, 0000000B.00000000.417289152.0000000005610000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.313851535.0000000005E60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.356358687.0000000005E60000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000000.346570335.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.370474867.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.402705506.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000000.347464851.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.403524936.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.288246090.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager,
Source: explorer.exe, 0000000B.00000000.347464851.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.403524936.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.288246090.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SwiftMessage_Unlocked_Transaction ProofMessage.exe.4215c38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	412 Process Injection	1 Masquerading	1 Input Capture	221 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	4 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SwiftMessage_Unlocked_Transaction ProofMessage.exe	38%	Virustotal		Browse
SwiftMessage_Unlocked_Transaction ProofMessage.exe	29%	ReversingLabs	ByteCode-MSIL.Spyware.Noon
SwiftMessage_Unlocked_Transaction ProofMessage.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\wKwiksScXFp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\wKwiksScXFp.exe	29%	ReversingLabs	ByteCode-MSIL.Spyware.Noon

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
8.0.SwiftMessage_Unlocked_Transaction ProofMessage.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.comessedG?1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
www.familism.net/qaom/	2%	Virustotal		Browse
www.familism.net/qaom/	100%	Avira URL Cloud	malware
http://www.fontbureau.comd7	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/lnlN?:	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn2	0%	Avira URL Cloud	safe
http://www.founder.c	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.fontbureau.comdnF	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/6	0%	URL Reputation	safe
http://www.founder.com.cn/cnb-n	0%	Avira URL Cloud	safe
http://en.wi	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.founder.com.cn/cnr	0%	URL Reputation	safe
http://www.carterandcone.comEach4	0%	Avira URL Cloud	safe
http://www.fontbureau.comicTFf	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.comgrito	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/%	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.founder.com.cn/cnZ	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.comtoTF	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.zhongyicts.com.cnlg?	0%	Avira URL Cloud	safe
http://www.fontbureau.comtu	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/xN	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comdQ	0%	Avira URL Cloud	safe
http://www.carterandcone.comz	0%	URL Reputation	safe
http://www.founder.com.cn/cn6	0%	URL Reputation	safe
http://www.fontbureau.comltvoN?:	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.fontbureau.comN?:	0%	Avira URL Cloud	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/f	0%	URL Reputation	safe
http://www.fontbureau.comalsd7	0%	Avira URL Cloud	safe
http://www.fontbureau.comE.TTF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0-s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.familism.net/qaom/	true	2%, Virustotal, Browse Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designerse1	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241302162.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comessedG?1	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241860717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comd7	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242188590.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242263259.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/lnlN?:	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn2	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.c	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236573699.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237645977.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237561745.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237607822.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237418195.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237253717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237348551.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237394542.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237371268.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comdnF	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241622575.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244725982.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244968212.00000000060D8000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245288432.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247776276.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246780981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245690952.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247331002.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247062279.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246315588.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245384768.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.250073464.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247030819.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245313604.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245752027.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.247266835.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.246402353.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersl	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241302162.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/6	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnb-n	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://en.wi	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236947938.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp//	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238618123.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238538445.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersd	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241339444.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241553390.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241401813.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241449552.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnr	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comEach4	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comicTFf	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243633570.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comgrito	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239517946.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239379153.00000000060B2000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comrsiv	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241315732.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241401813.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241562151.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241449552.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241226152.00000000060D4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/%	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnZ	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comtoTF	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242552714.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242746948.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designerss	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241315732.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.250073464.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244725982.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244841654.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245162197.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245031662.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.245128766.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244923054.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244954693.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244037027.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243761000.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243021518.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242772155.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244069272.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243727765.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.244008649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243982106.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242602401.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243789684.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242880352.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243930754.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242632805.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242810453.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnlg?	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237144267.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comtu	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242395978.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242364873.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242155357.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242439729.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242285774.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242312169.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242339210.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242188590.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242263259.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/xN	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239673589.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238423141.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239527886.00000000060D5000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238369385.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coma	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241622575.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.come.com	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.249977639.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248521016.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248657981.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248392812.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comdQ	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241349024.00000000060D4000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241370167.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comz	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.237725635.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn6	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.236463457.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comltvoN?:	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241999799.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241648999.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242085127.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241904236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242129232.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241839678.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241815649.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242064937.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241677362.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242107807.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241882852.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241936236.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241860717.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248203304.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.248249433.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000002.300706782.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comN?:	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241226152.00000000060D4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comalic	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.242526099.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/f	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239849647.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240076436.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240030862.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239999372.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239966190.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239773487.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239745515.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239942847.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239102986.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239569461.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239298805.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238795009.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comalsd7	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243578782.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243080983.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243054980.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243633570.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.241188909.00000000060CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comE.TTF	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243138269.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243170710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243338710.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243282875.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243379848.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243305544.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243458235.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243510605.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243106460.00000000060D0000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.243537061.00000000060D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0-s	SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239159133.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239849647.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240076436.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240030862.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240708870.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238714359.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239999372.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240479501.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239691705.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239966190.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239021418.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240758246.00000000060CF000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239713163.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240663615.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239397382.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240527492.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239773487.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.238640826.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239745515.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.240437508.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, SwiftMessage_Unlocked_Transaction ProofMessage.exe, 00000000.00000003.239942847.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680488
Start date and time: 08/08/202217:29:13	2022-08-08 17:29:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SwiftMessage_Unlocked_Transaction ProofMessage.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/8@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 59.9% (good quality ratio 52.3%) Quality average: 71.9% Quality standard deviation: 33.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 76 Number of non-executed functions: 160
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 80.67.82.235, 80.67.82.211
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, a1449.dscg2.akamai.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:30:25	API Interceptor	2x Sleep call for process: SwiftMessage_Unlocked_Transaction ProofMessage.exe modified
17:30:33	API Interceptor	41x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SwiftMessage_Unlocked_Transaction ProofMessage.exe.log

Download File

Process:	C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1308
Entropy (8bit):	5.345811588615766
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
MD5:	2E016B886BDB8389D2DD0867BE55F87B
SHA1:	25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
SHA-256:	1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
SHA-512:	C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22236
Entropy (8bit):	5.602477475466931
Encrypted:	false
SSDEEP:	384:UjtCD+0jMnIImRR3ISBKnYjsSC7Y9glSJ3x61BMrmnZ1AV7IW34564I+i6g:UyMn204KYoSWlcRe4Wo
MD5:	6E7008F2FCF3B8302C49D8EF64D1E314
SHA1:	4ADBC38563820BBA4F506BBC8887EFA3D637EEC9
SHA-256:	D53BF845E8818655EE6565446DD4C5A1342E1D21CC994D78B49DF508460C0DB7
SHA-512:	86AE814933641CCF5DFDA3DC4B93B58C50F2C9D97181F933126B70C6BE7EE3A87BE852B46ABCB2F1C93D4D8A98FAE2F08A19C8CF1AF1B2B1F5A84133E0E363D4
Malicious:	false
Reputation:	low
Preview:	@...e...........p...................@................@..........H...............<@.^.L."My...:P..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fcnwidmg.j4k.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wrsvjmzf.aep.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp

Download File

Process:	C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1598
Entropy (8bit):	5.142982930985104
Encrypted:	false
SSDEEP:	24:2di4+S2qh/S1KTy1moCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaPxvn:cgeKwYrFdOFzOzN33ODOiDdKrsuTqv
MD5:	235101EAAD05FEC8A207B7BB96081ED3
SHA1:	EE8454694B8F9ADF65E3A92D3FB48171ABC8ED31
SHA-256:	0F6A053C16BA89B1FA0BEA8A854E9986CD1C1E7C174080BD2384A575847228D3
SHA-512:	C464A7AFF91173EDADB14EC8192A9A316C6C7B6C79704903856EFF8E3417D893B80ABAD5D9DBCD0CC666BDD67D1CF6FC3139A12631E4DBA946E91F4312D91142
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <

C:\Users\user\AppData\Roaming\wKwiksScXFp.exe

Download File

Process:	C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	865280
Entropy (8bit):	7.723556535295317
Encrypted:	false
SSDEEP:	24576:ixgV10PpKEXK/UUHyINBMXlc1fe9IbUDHDl:agVWhtK/5pN2Xlyf7U
MD5:	ED3E368480CE9FDD917565B149D52E14
SHA1:	D8F888CFEE5175C6D4F8DA8007BF9E92CC5F0D87
SHA-256:	3D547C5731A7C08B7D25C4724CB9AE8A75CE246DC2715EE0E58EDBB5EC2221F8
SHA-512:	8766FC1BDA8908CFE6130AF60D0FA6AF47B7F89B7BBE5B10DF0BA127EAD213905C5BDDF86EED44027445A08ED0FF5A983809F6B7C4C31E2BAE0D71EB7502F538
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............0..,...........K... ...`....@.. ....................................@..................................K..W....`............................................................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................K......H........X..............................................................0..............0.............K...%.r...p.%.rS..p.%.ra..p.}......}.....(.... .cO. ....a%..^E....k...........M.......+i...(...... .c.mZ .g..a+...{.....(.....~....t.....{....(....&. ...;Z Q..,a+..{.....(..... ....Z ...a8r.......0..M........ V... .{).a%..^E........'...........+%.(..... ..@.Z ..M.a+... ...Z D5X.a+.....0..............0.................{....(.....(.....sA.....(.....(....(....( ........o9.

C:\Users\user\AppData\Roaming\wKwiksScXFp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Documents\20220808\PowerShell_transcript.358075.dN3uju++.20220808173030.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5793
Entropy (8bit):	5.400782329528835
Encrypted:	false
SSDEEP:	96:BZwjONYqDo1ZyZpjONYqDo1Z9rtjjZDjONYqDo1ZlyTTdZG:T
MD5:	B1B7833C5D478B84530FB1E7BB77DE47
SHA1:	249E79A212063F8E39AF6D7989BA589C652EFDE6
SHA-256:	49E4228F30F5FB7F34711DC35B143853406C949C863588D7499AD34C770BDA71
SHA-512:	A70AB104476E79B0A67F744B051E9050B7DD58DDCF1873A25900699930F30651BF48CA1567280322327EADED634F56B3048FED44B60790FDA8D8CD204A2FB294
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220808173032..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 358075 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\wKwiksScXFp.exe..Process ID: 4400..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220808173032..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\wKwiksScXFp.exe..********************..Windows PowerShell transcript start..Start time: 20220808173525..Username: computer\user..RunAs User: computer\jo

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.723556535295317
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SwiftMessage_Unlocked_Transaction ProofMessage.exe
File size:	865280
MD5:	ed3e368480ce9fdd917565b149d52e14
SHA1:	d8f888cfee5175c6d4f8da8007bf9e92cc5f0d87
SHA256:	3d547c5731a7c08b7d25c4724cb9ae8a75ce246dc2715ee0e58edbb5ec2221f8
SHA512:	8766fc1bda8908cfe6130af60d0fa6af47b7f89b7bbe5b10df0ba127ead213905c5bddf86eed44027445a08ed0ff5a983809f6b7c4c31e2bae0d71eb7502f538
SSDEEP:	24576:ixgV10PpKEXK/UUHyINBMXlc1fe9IbUDHDl:agVWhtK/5pN2Xlyf7U
TLSH:	0A059D5BBF10324DC567A975DE4B7C61A7F22C2A322AD07A7513380E8AFF742DA11076
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............0..,...........K... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4d4bde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x62F0FF81 [Mon Aug 8 12:20:17 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd4b84	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd6000	0x3a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd2be4	0xd2c00	False	0.7859103925711743	data	7.729603877475422	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd6000	0x3a8	0x400	False	0.37890625	data	2.954522289805604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd8000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xd6058	0x34c	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SwiftMessage_Unlocked_Transaction ProofMessage.exePID: 3144, Parent PID: 5972

General

Target ID:	0
Start time:	17:30:14
Start date:	08/08/2022
Path:	C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe"
Imagebase:	0xd30000
File size:	865280 bytes
MD5 hash:	ED3E368480CE9FDD917565B149D52E14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.287868209.0000000004215000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.285088525.0000000003392000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.281630024.0000000003165000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4400, Parent PID: 3144

General

Target ID:	3
Start time:	17:30:28
Start date:	08/08/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wKwiksScXFp.exe
Imagebase:	0x3a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3404, Parent PID: 4400

General

Target ID:	5
Start time:	17:30:29
Start date:	08/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5656, Parent PID: 3144

General

Target ID:	6
Start time:	17:30:29
Start date:	08/08/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wKwiksScXFp" /XML "C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp
Imagebase:	0xe20000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3608, Parent PID: 5656

General

Target ID:	7
Start time:	17:30:30
Start date:	08/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: SwiftMessage_Unlocked_Transaction ProofMessage.exePID: 1888, Parent PID: 3144

General

Target ID:	8
Start time:	17:30:34
Start date:	08/08/2022
Path:	C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SwiftMessage_Unlocked_Transaction ProofMessage.exe
Imagebase:	0xc20000
File size:	865280 bytes
MD5 hash:	ED3E368480CE9FDD917565B149D52E14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.275784202.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3616, Parent PID: 1888

General

Target ID:	11
Start time:	17:30:40
Start date:	08/08/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6f3b00000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000000.363258923.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000000.382443065.000000000D6A3000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2896, Parent PID: 3616

General

Target ID:	21
Start time:	17:31:42
Start date:	08/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.503381407.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000015.00000002.503590893.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SwiftMessage_Unlocked_Transaction ProofMessage.exePID: 3144, Parent PID: 5972COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	217
Total number of Limit Nodes:	8

Executed Functions

Function 05660E2C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05660F4A

Strings

\~n6, xrefs: 05660E66
\~n6, xrefs: 05660E86

Memory Dump Source

Source File: 00000000.00000002.291011547.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: CreateWindow
String ID: \~n6$\~n6
API String ID: 716092398-489576786
Opcode ID: c349b89c008972fd84283707807b541097a6f6d8da97e742aaa13804bfd63aba
Instruction ID: 2eb35d31c17decc9c02717c973f4f70f4c52d6d5cd890340a190dfbc8c9f84d5
Opcode Fuzzy Hash: c349b89c008972fd84283707807b541097a6f6d8da97e742aaa13804bfd63aba
Instruction Fuzzy Hash: 1451BFB1D003499FDB14CFA9C984ADEBFB5BF48314F24812AE819AB350D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05660E38 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05660F4A

Strings

\~n6, xrefs: 05660E66
\~n6, xrefs: 05660E86

Memory Dump Source

Source File: 00000000.00000002.291011547.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: CreateWindow
String ID: \~n6$\~n6
API String ID: 716092398-489576786
Opcode ID: 6a3b71c947e6721c840cd454c76a49942096c83a644e433782f9ff96548df996
Instruction ID: ab55d687ebba85d3aeab3b6f8b6e34dea61b8231d467adc5fd43956427bf9324
Opcode Fuzzy Hash: 6a3b71c947e6721c840cd454c76a49942096c83a644e433782f9ff96548df996
Instruction Fuzzy Hash: A841AFB1D003499FDF14CF99C984ADEBBB5BF48314F24812AE819AB350D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0150A470 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0150A6B6

Strings

\~n6, xrefs: 0150A66F

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: HandleModule
String ID: \~n6
API String ID: 4139908857-3392469484
Opcode ID: b3c13e004dedb8015b191d3a71ae45c517f00603f9727f4f06d126c13f0b74cf
Instruction ID: 4dda2db6949f76851f1555ba810b274ade7c87044f0f4da56d350ef314553866
Opcode Fuzzy Hash: b3c13e004dedb8015b191d3a71ae45c517f00603f9727f4f06d126c13f0b74cf
Instruction Fuzzy Hash: D77117B0A00B058FDB25DF6AD54479ABBF1BF88214F00892DD44ADBB90DB75E849CF91

Uniqueness

Uniqueness Score: -1.00%

Function 015058AC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01505969

Strings

\~n6, xrefs: 015058EC

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: Create
String ID: \~n6
API String ID: 2289755597-3392469484
Opcode ID: 554fd66c086fa119bf7b6ae83d0d5bf0b6f937eaafe45dbc1570db9bc25dd2d4
Instruction ID: 49924abea0b81c8622cdb3f42e0603d68389e18c14fbd5598b08faed4a909eb7
Opcode Fuzzy Hash: 554fd66c086fa119bf7b6ae83d0d5bf0b6f937eaafe45dbc1570db9bc25dd2d4
Instruction Fuzzy Hash: 1341E271C00719CBDB24CFA9C884BDEFBB1BF49318F24846AD408AB250EB71594ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 015040A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01505969

Strings

\~n6, xrefs: 015058EC

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: Create
String ID: \~n6
API String ID: 2289755597-3392469484
Opcode ID: 1f66df1d4c67979a8d2535af7021a7c98ac2b49acb48a15e98039dea3cbc801e
Instruction ID: e0b57028e86cd83a77ec12200aba75920142d4d4b5a0a145dd43d2ff4cdca98a
Opcode Fuzzy Hash: 1f66df1d4c67979a8d2535af7021a7c98ac2b49acb48a15e98039dea3cbc801e
Instruction Fuzzy Hash: 8E41F471C00619CBDB25CFA9C8847DEFBF5BF49318F20845AD409AB251EB74594ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 056633F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 056634B1

Strings

\~n6, xrefs: 05663407

Memory Dump Source

Source File: 00000000.00000002.291011547.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: CallProcWindow
String ID: \~n6
API String ID: 2714655100-3392469484
Opcode ID: 6caa877478213574f2797d46b0f740af74468fd6a87da4ddbefda83502461b9a
Instruction ID: 8a2d0e8a88f20b36a228afbf2bba9e84ee54f54e2b72188ad19b4a20bfda6dea
Opcode Fuzzy Hash: 6caa877478213574f2797d46b0f740af74468fd6a87da4ddbefda83502461b9a
Instruction Fuzzy Hash: F04145B5A00309CFCB10CF99C488AAEFBF5FB88314F14C559E519AB321C774A845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0150BF94 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0150C956,?,?,?,?,?), ref: 0150CA17

Strings

\~n6, xrefs: 0150C9AF

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DuplicateHandle
String ID: \~n6
API String ID: 3793708945-3392469484
Opcode ID: 3884ffb928d0cdf28cc59ba7afc8bebf5d8df1ba694ff46d68768d7773665555
Instruction ID: cc1648ef7f458bd20194ef9804962450179a360296d737b42d44666bc07e07e1
Opcode Fuzzy Hash: 3884ffb928d0cdf28cc59ba7afc8bebf5d8df1ba694ff46d68768d7773665555
Instruction Fuzzy Hash: B621E4B5D002489FDB10CFA9D884AEEBBF4FB49324F14845AE918B7350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0150C988 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0150C956,?,?,?,?,?), ref: 0150CA17

Strings

\~n6, xrefs: 0150C9AF

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DuplicateHandle
String ID: \~n6
API String ID: 3793708945-3392469484
Opcode ID: c27342a5dd29f436fb2a5c12e235a420261412d47010a52303b0adcfb82aba61
Instruction ID: 6966275f61c09e2152be647877a9d67b911aafd81c4786e2c121c75098b99205
Opcode Fuzzy Hash: c27342a5dd29f436fb2a5c12e235a420261412d47010a52303b0adcfb82aba61
Instruction Fuzzy Hash: F421E3B5D002489FDB10CFA9D984AEEBBF4FB48324F14842AE954B7750C378A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01509EA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0150A731,00000800,00000000,00000000), ref: 0150A942

Strings

\~n6, xrefs: 0150A8F7

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: LibraryLoad
String ID: \~n6
API String ID: 1029625771-3392469484
Opcode ID: 5dad21c3fd79bc8c2d6133c88ec5fe89a274746ef259c0120754a531d22db2bc
Instruction ID: 6e5cf4c2a96cfbd326bfeb037d3251fbfc2e81ec3a82afafe862d6e9ae852a10
Opcode Fuzzy Hash: 5dad21c3fd79bc8c2d6133c88ec5fe89a274746ef259c0120754a531d22db2bc
Instruction Fuzzy Hash: 4D219AB69003898FCB10CFA9C444BDEBBF4EB48220F04842AD555AB651C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0150A8D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0150A731,00000800,00000000,00000000), ref: 0150A942

Strings

\~n6, xrefs: 0150A8F7

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: LibraryLoad
String ID: \~n6
API String ID: 1029625771-3392469484
Opcode ID: c9927d76f3a7fe5ee5a26666d177a0a9f18c2c141bd07da2ceb1f2c66b533de1
Instruction ID: d6aee01e91fa04a0d235579511696bb241f068835ee474c503ac430ed433ef02
Opcode Fuzzy Hash: c9927d76f3a7fe5ee5a26666d177a0a9f18c2c141bd07da2ceb1f2c66b533de1
Instruction Fuzzy Hash: 061103B69003498FDB10CF9AD884AEEBBF4AB48324F04842AD919A7640C774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01509EC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0150A731,00000800,00000000,00000000), ref: 0150A942

Strings

\~n6, xrefs: 0150A8F7

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: LibraryLoad
String ID: \~n6
API String ID: 1029625771-3392469484
Opcode ID: 44821e87e8c201ba379c95ec1344bb2d7bf002099c2403665cdfa19de22d3f4a
Instruction ID: 37ede4e3c620ab5a58b1c9b4d90cdff6a7171140c73e8eaf93e5f5c269d7bf2f
Opcode Fuzzy Hash: 44821e87e8c201ba379c95ec1344bb2d7bf002099c2403665cdfa19de22d3f4a
Instruction Fuzzy Hash: 161114B69003498FDB10CF9AD484BEEFBF4FB48324F10842AE919A7640C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0150A650 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0150A6B6

Strings

\~n6, xrefs: 0150A66F

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: HandleModule
String ID: \~n6
API String ID: 4139908857-3392469484
Opcode ID: 2e6c4a2769144b8743671b1723b6864a88737cf855cc21208408d3a64e4d8b76
Instruction ID: 8c5d4c2982bf263374e043f4f829e6e9381c981d646dc3bd6e417679f6261d92
Opcode Fuzzy Hash: 2e6c4a2769144b8743671b1723b6864a88737cf855cc21208408d3a64e4d8b76
Instruction Fuzzy Hash: E711E0B6C017498FDB10CF9AD844BDEFBF8AB89324F14841AD929B7650C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05661079 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 056610DD

Strings

\~n6, xrefs: 0566109A

Memory Dump Source

Source File: 00000000.00000002.291011547.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: LongWindow
String ID: \~n6
API String ID: 1378638983-3392469484
Opcode ID: 7e0e8f7f05f6bb476ac5400b2ab53f0e59f3c0591612f289c80d344ed728daac
Instruction ID: 965aac496cd904840205406a43a4d8fe2e21959b5e6c9134266d86557d13c1be
Opcode Fuzzy Hash: 7e0e8f7f05f6bb476ac5400b2ab53f0e59f3c0591612f289c80d344ed728daac
Instruction Fuzzy Hash: 7A11F2B58002499FDB10CF99D889BEFBBF8EB48324F10841AE919A7700C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05661080 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 056610DD

Strings

\~n6, xrefs: 0566109A

Memory Dump Source

Source File: 00000000.00000002.291011547.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5660000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: LongWindow
String ID: \~n6
API String ID: 1378638983-3392469484
Opcode ID: ca094f26d36ab07a99faf6e126eacbdae1d0b9f37af303dca9dbfa7a37501413
Instruction ID: dc4bb9cbbbe8355d523232c064f57fb6010476605373a015d401d75a5851e5b7
Opcode Fuzzy Hash: ca094f26d36ab07a99faf6e126eacbdae1d0b9f37af303dca9dbfa7a37501413
Instruction Fuzzy Hash: B61115B58002498FDB10CF99D485BDEFBF8FB48324F10841AD915A7700C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0139D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278114170.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719ac262428e99c5b83b6ed6fde668a908bc63a0e380f1e28db95469243c4e8f
Instruction ID: 5f1e654287c658de7d2abd7a1de63947d36fbe3b556ea21e333238a6e580a9e1
Opcode Fuzzy Hash: 719ac262428e99c5b83b6ed6fde668a908bc63a0e380f1e28db95469243c4e8f
Instruction Fuzzy Hash: C62125B1500244EFDF01DF54D9C1B6ABF65FB8832CF24C569E8051B616C336D846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278194770.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e388becb7024b1c8db3ec97a6e4faf23122d4aa549c2f8f9a8f77f7f822294a
Instruction ID: e87be91dd9adb7949097f417b56b5ce8200d3071fafdbbe504802b157e5219b5
Opcode Fuzzy Hash: 2e388becb7024b1c8db3ec97a6e4faf23122d4aa549c2f8f9a8f77f7f822294a
Instruction Fuzzy Hash: 93214570544244DFCB11CF64D8C0B16BB65FB84358F60C56DD8094BB46C33AD80ACAA1

Uniqueness

Uniqueness Score: -1.00%

Function 013AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278194770.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb7e41e114ecfe73b0f03d638418871bbca230765792c2278c37ac937738a92
Instruction ID: 8886042939b959b4ca85f691a26e31eff076079d8c0080613fcdb2204cf41423
Opcode Fuzzy Hash: ddb7e41e114ecfe73b0f03d638418871bbca230765792c2278c37ac937738a92
Instruction Fuzzy Hash: FD212975504244EFDB05CF94D9C0B2ABB65FB8432CF64C56DE8094BB52C73AD846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 013AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278194770.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4676d1b7d566ae44a48cb97668edf657622df438ecf5fe1e62ad7aac76aaea
Instruction ID: 6517e14f5863af1806d2732a9459c59e000414a2c378b240d28b8226526fe635
Opcode Fuzzy Hash: 7b4676d1b7d566ae44a48cb97668edf657622df438ecf5fe1e62ad7aac76aaea
Instruction Fuzzy Hash: 0D2180754483809FCB03CF24D994B11BF71EB46218F28C5DAD8898F667C33A985ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0139D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278114170.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc266a14d3ef7d67b01d83a3dd366f49f170e6375fe939ec088120573f0f532
Instruction ID: 44bb69b1dd4cd44f6c0ced7ec31c21ae110b63616ed7bdbce7f80518a8d27185
Opcode Fuzzy Hash: 5cc266a14d3ef7d67b01d83a3dd366f49f170e6375fe939ec088120573f0f532
Instruction Fuzzy Hash: 7911D376404280DFDF12CF54D5C5B16BF71FB84328F24C6A9D8454B616C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278194770.00000000013AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13ad000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4af9a06ffb61d74dcaa5232f3e705a97e1126696a135aabd0f2606d4194c68c
Instruction ID: 055a77c4fe92df80948777cafb40d19a71be66ca86642fb78a963de62ef40fc1
Opcode Fuzzy Hash: a4af9a06ffb61d74dcaa5232f3e705a97e1126696a135aabd0f2606d4194c68c
Instruction Fuzzy Hash: AD118B75504280DFDB12CF54D5C4B15BBB1FB85228F28C6ADD8494BA66C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0139D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278114170.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6504a85802923bde4cf2ef3146b9ae47ea4d7e732f244be3ac4cc040cb04d3b
Instruction ID: 53775d87cfda5de74e0107ba0a651be436759e193ac31a59eb7e2e366dc3e84f
Opcode Fuzzy Hash: e6504a85802923bde4cf2ef3146b9ae47ea4d7e732f244be3ac4cc040cb04d3b
Instruction Fuzzy Hash: 290147350043C49AEB104E59CC85BAEBF9CDF4123CF08841AED051B642D3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0139D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278114170.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938e77cc77e9b1501bf18a6c244b79c1ada6a9b68af415ad1ce91365554233d5
Instruction ID: 39cfae5c62a87b1d62000a192e3a997aab52a8d680511c8ced97056ea2e46539
Opcode Fuzzy Hash: 938e77cc77e9b1501bf18a6c244b79c1ada6a9b68af415ad1ce91365554233d5
Instruction Fuzzy Hash: 83F062714042C49AEB118E59DC89B66FFA8EB41678F18C45AED085B686C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0150F250 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16dc4ce4bd579a75e6f958beb07e3b986f3b8dd21d77026ba3b59daaa58c6e8a
Instruction ID: 9bdc293d94eedd229c98f3dd0edb9095485c4659147c0ac570f0bd9fa182c3d2
Opcode Fuzzy Hash: 16dc4ce4bd579a75e6f958beb07e3b986f3b8dd21d77026ba3b59daaa58c6e8a
Instruction Fuzzy Hash: BF12D6F14217468AD334CF65E8981893BA1B74532AB926208D2725FBD8E7F8018FFF54

Uniqueness

Uniqueness Score: -1.00%

Function 0150D2AC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050f2854b7e5ff26cd1a6fd70b53e1dda415825b587a9a282d82cefa1f89432e
Instruction ID: 3617f1d9f996d55ca360b30549e75da842f9cb5c7ce8846f5f57c1eae19fab59
Opcode Fuzzy Hash: 050f2854b7e5ff26cd1a6fd70b53e1dda415825b587a9a282d82cefa1f89432e
Instruction Fuzzy Hash: 5BA16C32E0021A8FCF16DFE5C8445DDBBB2FFC9300B25856AE915AF261EB31A955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0150F240 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.278701804.0000000001500000.00000040.00000800.00020000.00000000.sdmp, Offset: 01500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1500000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 371406f2c39fdd939b16a477a008731e6a56f82bad5bdce223ea2169f3d8d8b2
Instruction ID: 8660b68afc29820cb28406993add7bf00127012686b3777a666eaecde76ce15e
Opcode Fuzzy Hash: 371406f2c39fdd939b16a477a008731e6a56f82bad5bdce223ea2169f3d8d8b2
Instruction Fuzzy Hash: EFC138B14217468AD720CF65E8981893BA1BB85329F526309D2726F7D8E7F8108FFF54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SwiftMessage_Unlocked_Transaction ProofMessage.exePID: 1888, Parent PID: 3144COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50.4%
Total number of Nodes:	1660
Total number of Limit Nodes:	68

Executed Functions

Function 01769910 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0176991A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3b7ec3c7f00e4e1dc38ad3a6eca6a59e38a7acdafee68c74fee2a56500caa367
Instruction ID: 41db17f53036bf236683fb5e74921d43bffaf95b46eb89b84d0cfc802d3615b8
Opcode Fuzzy Hash: 3b7ec3c7f00e4e1dc38ad3a6eca6a59e38a7acdafee68c74fee2a56500caa367
Instruction Fuzzy Hash: FC9002B120500406E550719984047464005ABD4341F51C021A5055554EC6998DD576A5

Uniqueness

Uniqueness Score: -1.00%

Function 017699A0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 017699AA

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1855d05c729eb2cc7cd88ea147b4c67b106649b669fc27bf3f8284f27a39c6e8
Instruction ID: 85345dcabcb083d71d903031c75b2927d4285d5a32004c2501fe04e4a7ec05a3
Opcode Fuzzy Hash: 1855d05c729eb2cc7cd88ea147b4c67b106649b669fc27bf3f8284f27a39c6e8
Instruction Fuzzy Hash: 3F9002A134500446E51061998414B064005EBE5341F51C025E1055554DC659CC527166

Uniqueness

Uniqueness Score: -1.00%

Function 01769860 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0176986A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c3b127a8c85e8b900b57cc8d7abd95e05a7f6798a06472237b145b2b90e8a79f
Instruction ID: ab3862a7901da0baac5cd6f3e9f1704e57735ac083d3eadb3391a1bce6efd1be
Opcode Fuzzy Hash: c3b127a8c85e8b900b57cc8d7abd95e05a7f6798a06472237b145b2b90e8a79f
Instruction Fuzzy Hash: 0E90027120500417E521619985047074009ABD4281F91C422A0415558DD6968952B161

Uniqueness

Uniqueness Score: -1.00%

Function 01769840 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0176984A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2302a892617c871ea61e4b3be71ca68e1937bdda545b26c4285e7c67468ce8e6
Instruction ID: 1e4b7ad3ca4c3f32ff46deaa9077e277f82565e0ca1545421e25891e8b79f712
Opcode Fuzzy Hash: 2302a892617c871ea61e4b3be71ca68e1937bdda545b26c4285e7c67468ce8e6
Instruction Fuzzy Hash: ED900261246041566955B19984045078006BBE4281B91C022A1405950CC5669856F661

Uniqueness

Uniqueness Score: -1.00%

Function 017698F0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 017698FA

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 65bc9f369eacf39aa5aa9529d05fddd01197d8446d6a2a42884007b6a12ca32b
Instruction ID: af3f597b3227e2f3171206b46ba91ee7dc8bf4ad98d7966bac02394b0ecf29f7
Opcode Fuzzy Hash: 65bc9f369eacf39aa5aa9529d05fddd01197d8446d6a2a42884007b6a12ca32b
Instruction Fuzzy Hash: BC90026160500506E51171998404616400AABD4281F91C032A1015555ECA658992B171

Uniqueness

Uniqueness Score: -1.00%

Function 01769A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01769A5A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa697f00c78aceaf04e1d7be819953edc056a6766e3b53132708f782feaf6553
Instruction ID: a02d26d7ec26557fa181d3ec39b2f3ad4bf1ce3a3fc096032b69ae73303a77d7
Opcode Fuzzy Hash: aa697f00c78aceaf04e1d7be819953edc056a6766e3b53132708f782feaf6553
Instruction Fuzzy Hash: C390026121580046E61065A98C14B074005ABD4343F51C125A0145554CC95588617561

Uniqueness

Uniqueness Score: -1.00%

Function 01769A20 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01769A2A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efd4ce2bede35fdb560998d71dcc91999d6c758b5a4af0e1cb27f077d3499508
Instruction ID: 93b2918735910b99c5ac5fb30bfc7285c626a2f393a55757f000d89d55bf53e6
Opcode Fuzzy Hash: efd4ce2bede35fdb560998d71dcc91999d6c758b5a4af0e1cb27f077d3499508
Instruction Fuzzy Hash: D690026160500046555071A9C8449068005BFE5251B51C131A0989550DC599886576A5

Uniqueness

Uniqueness Score: -1.00%

Function 01769A00 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01769A0A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dc6512260e85df7c45bd5200a9d5774c4ae74ef03ab3138fc84f3575d10c9914
Instruction ID: b72538b98324365cb001214bd80bbffccba99bc8c99e09337e7f542d07eb3b24
Opcode Fuzzy Hash: dc6512260e85df7c45bd5200a9d5774c4ae74ef03ab3138fc84f3575d10c9914
Instruction Fuzzy Hash: 6990027120540406E5106199881470B4005ABD4342F51C021A1155555DC665885175B1

Uniqueness

Uniqueness Score: -1.00%

Function 01769540 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0176954A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0c44aa92e2726fc247f318362d6cf83594c057c9d956502240ffe331feea4798
Instruction ID: cc3be875291a58386923c41f57e0ad25db2b7567e7110d86d32fcebe20094fbb
Opcode Fuzzy Hash: 0c44aa92e2726fc247f318362d6cf83594c057c9d956502240ffe331feea4798
Instruction Fuzzy Hash: 80900265215000071515A59947045074046ABD9391751C031F1006550CD66188617161

Uniqueness

Uniqueness Score: -1.00%

Function 017695D0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 017695DA

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 82dff45acca7a2f98759b64f8c17e0137c2bdc7a4d3dd81359f2500b17ed225b
Instruction ID: 65a73f744fc07f38f2a09f5f0ba78e3179e34f0244e312607a63ccca7495a616
Opcode Fuzzy Hash: 82dff45acca7a2f98759b64f8c17e0137c2bdc7a4d3dd81359f2500b17ed225b
Instruction Fuzzy Hash: CA9002A120600007551571998414616800AABE4241F51C031E1005590DC56588917165

Uniqueness

Uniqueness Score: -1.00%

Function 01769710 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0176971A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8ac9c2c243e089a8055a7eb8f0a4928f19467bf3517342ea154e764603ac85df
Instruction ID: b6c5b6871a7e29c81c08ab637b0a02e3765e026fea86d67d36b56386f062e68e
Opcode Fuzzy Hash: 8ac9c2c243e089a8055a7eb8f0a4928f19467bf3517342ea154e764603ac85df
Instruction Fuzzy Hash: 0190027120500406E51065D994086464005ABE4341F51D021A5015555EC6A588917171

Uniqueness

Uniqueness Score: -1.00%

Function 01769FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01769FEA

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 065a0d73646474b0942eca30cccd006219523a06f8acfe19acc71b60c022db2f
Instruction ID: c3613e7bc6d308cb353a6f690ee8665c6b53d4496eac8c5b642b0cbc71c6c263
Opcode Fuzzy Hash: 065a0d73646474b0942eca30cccd006219523a06f8acfe19acc71b60c022db2f
Instruction Fuzzy Hash: CD90027131514406E5206199C4047064005ABD5241F51C421A0815558DC6D588917162

Uniqueness

Uniqueness Score: -1.00%

Function 017697A0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 017697AA

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fc61d373af965fd5d45131fb000684396c314498ffaeeefb71c74028403ac035
Instruction ID: f117de092d587c33459a25062b807e61e062b987ea55bb6f1c60c82f92208d27
Opcode Fuzzy Hash: fc61d373af965fd5d45131fb000684396c314498ffaeeefb71c74028403ac035
Instruction Fuzzy Hash: E390026130500007E550719994186068005FBE5341F51D021E0405554CD95588567262

Uniqueness

Uniqueness Score: -1.00%

Function 01769780 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0176978A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa52d36a84d0273691903bdad3f28c3514deab8e4c0efdfa4256c263ea74d00a
Instruction ID: aedf042fddeda9bde598596a1d668954a518aa5f0753c1b9028c37022a549ea9
Opcode Fuzzy Hash: aa52d36a84d0273691903bdad3f28c3514deab8e4c0efdfa4256c263ea74d00a
Instruction Fuzzy Hash: 8190026921700006E5907199940860A4005ABD5242F91D425A0006558CC95588697361

Uniqueness

Uniqueness Score: -1.00%

Function 01769660 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0176966A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a21cc7bfb2c27821711e6c55f438f466a47d7570d0412c71731a6f674c912145
Instruction ID: 63844c1fa4f5d668bed9a1088b74e07b98bb22c5542fb05c463bf62b3bf40671
Opcode Fuzzy Hash: a21cc7bfb2c27821711e6c55f438f466a47d7570d0412c71731a6f674c912145
Instruction Fuzzy Hash: E690027120500806E5907199840464A4005ABD5341F91C025A0016654DCA558A5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 017696E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 017696EA

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3813fa6e430a4930baca43b208197d956e875da9b3588f8ada0cc52309e9bb84
Instruction ID: d86571d894426b3fd2a2acd2caa90ea8d76dab3b3eb1235b4ae455faedb57d65
Opcode Fuzzy Hash: 3813fa6e430a4930baca43b208197d956e875da9b3588f8ada0cc52309e9bb84
Instruction Fuzzy Hash: 1590027120508806E5206199C40474A4005ABD4341F55C421A4415658DC6D588917161

Uniqueness

Uniqueness Score: -1.00%

Function 0176967A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01769694

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 823be80f2958445d043060c798fe63d5d6bd981444234b8480c75af45027bcef
Instruction ID: ec1d6316e0333c77409d119ad58c22b7545d10117bf9b7520f36dc85f8fad36b
Opcode Fuzzy Hash: 823be80f2958445d043060c798fe63d5d6bd981444234b8480c75af45027bcef
Instruction Fuzzy Hash: F1B09B719055C5CDEA11D7A44708717F9047BD4745F16C061D2020641B4778C491F5B5

Uniqueness

Uniqueness Score: -1.00%

Function 00420881 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427255647.0000000000420000.00000040.00000400.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_420000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c717546b5765e675441d7ba57dc6b55d6ab4561c2de3624a1ef65c4a5e4b7b44
Instruction ID: 4e8a861f1062a8940624714fd4c2f1b73268762d94692cf4fc0f3d0b5a05ce80
Opcode Fuzzy Hash: c717546b5765e675441d7ba57dc6b55d6ab4561c2de3624a1ef65c4a5e4b7b44
Instruction Fuzzy Hash: 12D022296E4304028A0271B22E836AABF40D80712278003CFFC0A82903A41B00AE43E1

Uniqueness

Uniqueness Score: -1.00%

Function 00420890 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427255647.0000000000420000.00000040.00000400.00020000.00000000.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_420000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6144cc19801289772d49dbec6ba8e925cc214af052d1a8482921be8100755dad
Instruction ID: d68276b9a6680643f2f113c7ba5ef9133f6d4ed1aa7c1c45a7bf2786640efd4c
Opcode Fuzzy Hash: 6144cc19801289772d49dbec6ba8e925cc214af052d1a8482921be8100755dad
Instruction Fuzzy Hash: FEA00265E8930D17042475FA2E47467BB5D8551519F8003EAED4D06A46BC46A87501EB

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 017DB260 Relevance: 37.8, Strings: 30, Instructions: 262COMMONLIBRARYCODE

Download Yara Rule

Strings

*** enter .exr %p for the exception record, xrefs: 017DB4F1
*** enter .cxr %p for the context, xrefs: 017DB50D
*** Inpage error in %ws:%s, xrefs: 017DB418
The resource is owned exclusively by thread %p, xrefs: 017DB374
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 017DB484
The critical section is owned by thread %p., xrefs: 017DB3B9
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 017DB47D
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 017DB2DC
write to, xrefs: 017DB4A6
a NULL pointer, xrefs: 017DB4E0
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 017DB314
<unknown>, xrefs: 017DB27E, 017DB2D1, 017DB350, 017DB399, 017DB417, 017DB48E
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 017DB305
The instruction at %p referenced memory at %p., xrefs: 017DB432
The instruction at %p tried to %s , xrefs: 017DB4B6
Go determine why that thread has not released the critical section., xrefs: 017DB3C5
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 017DB38F
*** Resource timeout (%p) in %ws:%s, xrefs: 017DB352
*** An Access Violation occurred in %ws:%s, xrefs: 017DB48F
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 017DB39B
*** A stack buffer overrun occurred in %ws:%s, xrefs: 017DB2F3
*** then kb to get the faulting stack, xrefs: 017DB51C
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 017DB53F
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 017DB476
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 017DB3D6
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 017DB323
The resource is owned shared by %d threads, xrefs: 017DB37E
read from, xrefs: 017DB4AD, 017DB4B2
This failed because of error %Ix., xrefs: 017DB446
an invalid address, %p, xrefs: 017DB4CF

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: b5bd579286bfd14fdb7b27a031a931f16c29b2780bcbcef70c6c9d2459185201
Instruction ID: efc932a8d8140d499c83e1bc80127e704fd69492081e855041460f6616ed2b3d
Opcode Fuzzy Hash: b5bd579286bfd14fdb7b27a031a931f16c29b2780bcbcef70c6c9d2459185201
Instruction Fuzzy Hash: 66812475A00214FFDB229E8ACC9DEABFB35EF57A51F420088F5042B11AD7768501DAB2

Uniqueness

Uniqueness Score: -1.00%

Function 017E1C06 Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E017E1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x17048a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0172B150();
				} else {
					E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x181589c);
				E0172B150("Heap error detected at %p (heap handle %p)\n",  *0x18158a0);
				_t27 =  *0x1815898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M017E1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0172B150();
				} else {
					E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0172B150("Error code: %d - %s\n",  *0x1815898);
				_t113 =  *0x18158a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0172B150();
					} else {
						E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0172B150("Parameter1: %p\n",  *0x18158a4);
				}
				_t115 =  *0x18158a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0172B150();
					} else {
						E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0172B150("Parameter2: %p\n",  *0x18158a8);
				}
				_t117 =  *0x18158ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0172B150();
					} else {
						E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0172B150("Parameter3: %p\n",  *0x18158ac);
				}
				_t119 =  *0x18158b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0172B150();
					} else {
						E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x18158b4);
					E0172B150("Last known valid blocks: before - %p, after - %p\n",  *0x18158b0);
				} else {
					_t120 =  *0x18158b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0172B150();
				} else {
					E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0172B150("Stack trace available at %p\n", 0x18158c0);
			}

0x017e1c10
0x017e1c16
0x017e1c1e
0x017e1c3d
0x017e1c3e
0x017e1c20
0x017e1c35
0x017e1c3a
0x017e1c44
0x017e1c55
0x017e1c5a
0x017e1c65
0x017e1c67
0x00000000
0x017e1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x017e1c67
0x017e1cdc
0x017e1ce5
0x017e1d04
0x017e1d05
0x017e1ce7
0x017e1cfc
0x017e1d01
0x017e1d0b
0x017e1d17
0x017e1d1f
0x017e1d25
0x017e1d30
0x017e1d4f
0x017e1d50
0x017e1d32
0x017e1d47
0x017e1d4c
0x017e1d61
0x017e1d67
0x017e1d68
0x017e1d6e
0x017e1d79
0x017e1d98
0x017e1d99
0x017e1d7b
0x017e1d90
0x017e1d95
0x017e1daa
0x017e1db0
0x017e1db1
0x017e1db7
0x017e1dc2
0x017e1de1
0x017e1de2
0x017e1dc4
0x017e1dd9
0x017e1dde
0x017e1df3
0x017e1df9
0x017e1dfa
0x017e1e00
0x017e1e0a
0x017e1e13
0x017e1e32
0x017e1e33
0x017e1e15
0x017e1e2a
0x017e1e2f
0x017e1e39
0x017e1e4a
0x017e1e02
0x017e1e02
0x017e1e08
0x00000000
0x00000000
0x017e1e08
0x017e1e5b
0x017e1e7a
0x017e1e7b
0x017e1e5d
0x017e1e72
0x017e1e77
0x017e1e95

Strings

heap_failure_generic, xrefs: 017E1C7C
heap_failure_virtual_block_corruption, xrefs: 017E1C91
heap_failure_block_not_busy, xrefs: 017E1CA6
Parameter3: %p, xrefs: 017E1DEE
Stack trace available at %p, xrefs: 017E1E86
heap_failure_internal, xrefs: 017E1C6E
heap_failure_buffer_overrun, xrefs: 017E1C98
heap_failure_invalid_argument, xrefs: 017E1CAD
HEAP: , xrefs: 017E1C16, 017E1C3D, 017E1D04, 017E1D4F, 017E1D98, 017E1DE1, 017E1E32, 017E1E7A
heap_failure_multiple_entries_corruption, xrefs: 017E1C8A
Error code: %d - %s, xrefs: 017E1D12
Parameter2: %p, xrefs: 017E1DA5
heap_failure_entry_corruption, xrefs: 017E1C83
heap_failure_invalid_allocation_type, xrefs: 017E1CB4
Heap error detected at %p (heap handle %p), xrefs: 017E1C50
heap_failure_listentry_corruption, xrefs: 017E1CD0
HEAP[%wZ]: , xrefs: 017E1C30, 017E1CF7, 017E1D42, 017E1D8B, 017E1DD4, 017E1E25, 017E1E6D
heap_failure_unknown, xrefs: 017E1C75
heap_failure_lfh_bitmap_mismatch, xrefs: 017E1CD7
heap_failure_freelists_corruption, xrefs: 017E1CC9
Last known valid blocks: before - %p, after - %p, xrefs: 017E1E45
heap_failure_buffer_underrun, xrefs: 017E1C9F
heap_failure_cross_heap_operation, xrefs: 017E1CC2
heap_failure_usage_after_free, xrefs: 017E1CBB
Parameter1: %p, xrefs: 017E1D5C

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 17757b56766dd2d93bb778b2d81cab9bdb9e40338a65690b9c120d14fc6e7c84
Instruction ID: 1a3ffc9d6287022e350e272a1140b69de0f727f9c8a6c622c923314b437ea3ce
Opcode Fuzzy Hash: 17757b56766dd2d93bb778b2d81cab9bdb9e40338a65690b9c120d14fc6e7c84
Instruction Fuzzy Hash: 1E61F433514155DFD312AB8DD49EE21F3E4EB08A30B9980BEFC099B359DA309D918F0A

Uniqueness

Uniqueness Score: -1.00%

Function 01758E00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 126
timeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E01758E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x181d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1818464; // 0x76c90110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1815780 & 0x00000003) != 0) {
							E017A5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1815780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E0176B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1817984; // 0x1122bf8
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1818464; // 0x76c90110
					 *0x181b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E01759B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1815780 & 0x00000005) != 0) {
						_push(_t49);
						E017A5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x01758e0f
0x01758e16
0x01758e19
0x01758e1b
0x01758e21
0x01758e7f
0x01758e85
0x01799354
0x0179936c
0x01799371
0x0179937b
0x01799381
0x01799381
0x0179937b
0x01758e9d
0x01758e9d
0x01758e29
0x01758e2c
0x01758e38
0x01758e3e
0x01758e43
0x01758eb5
0x01758eb9
0x017992aa
0x017992af
0x017992e8
0x017992e8
0x017992af
0x01758eb9
0x01758e45
0x01758e53
0x01758e5b
0x01758e5f
0x01758e78
0x01758e78
0x01758e7d
0x01758ec3
0x01758ecd
0x01758ed2
0x01758ed2
0x01758ec5
0x01758ec5
0x00000000
0x01758e7d
0x01758e67
0x01758ea4
0x0179931a
0x00000000
0x00000000
0x01799320
0x01758ea4
0x01758e70
0x01799325
0x01799340
0x01799345
0x01799345
0x01758e76
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 01758E53

Strings

LdrpFindDllActivationContext, xrefs: 01799331, 0179935D
Querying the active activation context failed with status 0x%08lx, xrefs: 01799357
minkernel\ntdll\ldrsnap.c, xrefs: 0179933B, 01799367
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 0179932A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: 36f3b904de8ed530b62f982b2d9e17e465805ac94bc11ee5ae37d615f9ff93d5
Instruction ID: 715a0f2b77eec08363bc0f71452a8de688f1c80de5230e0e86af02a7b4a1bdc8
Opcode Fuzzy Hash: 36f3b904de8ed530b62f982b2d9e17e465805ac94bc11ee5ae37d615f9ff93d5
Instruction Fuzzy Hash: 12413B32A00315DFEFB26A1F9889A35F6B5AB09304F09456DED0497191EBF05D809783

Uniqueness

Uniqueness Score: -1.00%

Function 01733D34 Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E01733D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E01731B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E01731B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E01731B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E01731B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E01731B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L01744620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E0176F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E01771370(_t276, 0x1704e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E0176BB40(0,  &_v68, _t170);
									if(L017343C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E0176BB40(_t257,  &_v68, _t243);
								if(L017343C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E01771370(_t278, 0x1704e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L01744620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E0176F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E01771370(_v16, 0x1704e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E0176BB40(_t262,  &_v68, _t244);
								if(L017343C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E01771370(_t282, 0x1704e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E0176BB40(_t262,  &_v68, _t201);
							if(L017343C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L01744620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E0176F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E01771370(_t280, 0x1704e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E0176BB40(_t267,  &_v68, _t245);
							if(L017343C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E01771370(_t284, 0x1704e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E0176BB40(_t267,  &_v68, _t224);
						if(L017343C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x01733d3c
0x01733d42
0x01733d44
0x01733d46
0x01733d49
0x01733d4c
0x01733d4f
0x01733d52
0x01733d55
0x01733d58
0x01733d5b
0x01733d5f
0x01733d61
0x01733d66
0x01788213
0x01788218
0x01734085
0x01734088
0x0173408e
0x01734094
0x0173409a
0x017340a0
0x017340a6
0x017340a9
0x017340af
0x017340b6
0x017340bd
0x017340bd
0x01733d83
0x0178821f
0x01788229
0x01788238
0x01788238
0x0178823d
0x0178823d
0x01733da0
0x01733daf
0x01733db5
0x01733dba
0x01733dba
0x01733dd4
0x01733e94
0x01733eab
0x01733f6d
0x01733f84
0x0173406b
0x0173406b
0x0173406e
0x0173406e
0x01734070
0x01734074
0x01788351
0x01788351
0x0173407a
0x0173407f
0x0178835d
0x01788370
0x01788377
0x01788379
0x0178837c
0x0178837c
0x0178835d
0x00000000
0x0173407f
0x01733f8a
0x01733f8d
0x01733f90
0x01733f95
0x0178830d
0x0178830f
0x01733f9b
0x01733fac
0x01733fae
0x01733fb1
0x01733fb1
0x01733fb6
0x01788317
0x0178831a
0x00000000
0x01733fbc
0x01733fc1
0x01733fc9
0x01733fd7
0x01733fda
0x01733fdd
0x01734021
0x01734021
0x01734029
0x01734030
0x01734044
0x01734046
0x01734046
0x01734044
0x01734049
0x01788327
0x01788334
0x01788339
0x0178833c
0x0173404f
0x0173404f
0x0173404f
0x01734051
0x01734056
0x01734063
0x01734063
0x01734068
0x00000000
0x01734068
0x01733fdf
0x01733fe2
0x01733fe4
0x01733fe7
0x01733fef
0x01734003
0x01734005
0x01734005
0x0173400c
0x01734013
0x01734016
0x01734017
0x0173401b
0x0173401e
0x00000000
0x0173401e
0x01733fb6
0x01733eb1
0x01733eb4
0x01733eb7
0x01733ebc
0x017882a9
0x017882ab
0x01733ec2
0x01733ed3
0x01733ed5
0x01733ed8
0x01733ed8
0x01733edd
0x017882b3
0x017882b6
0x00000000
0x01733ee3
0x01733ee8
0x01733eed
0x01733ef0
0x01733ef3
0x01733f02
0x01733f05
0x01733f08
0x017882c0
0x017882c3
0x017882c5
0x017882c8
0x017882d0
0x017882e4
0x017882e6
0x017882e6
0x017882ed
0x017882f4
0x017882f7
0x017882f8
0x017882fc
0x017882ff
0x017882ff
0x01733f0e
0x01733f11
0x01733f16
0x01733f1d
0x01733f31
0x01788307
0x01788307
0x01733f31
0x01733f39
0x01733f48
0x01733f4d
0x01733f50
0x01733f50
0x01733f53
0x01733f58
0x01733f65
0x01733f65
0x01733f6a
0x00000000
0x01733f6a
0x01733edd
0x01733dda
0x01733ddd
0x01733de0
0x01733de5
0x01788245
0x01733deb
0x01733df7
0x01733dfc
0x01733dfe
0x01733e01
0x01733e01
0x01733e06
0x0178824d
0x0178824f
0x01788254
0x00000000
0x01733e0c
0x01733e11
0x01733e16
0x01733e19
0x01733e29
0x01733e2c
0x01733e2f
0x0178825c
0x0178825f
0x01788261
0x01788264
0x0178826c
0x01788280
0x01788282
0x01788282
0x01788289
0x01788290
0x01788293
0x01788294
0x01788298
0x0178829b
0x0178829b
0x01733e35
0x01733e38
0x01733e3d
0x01733e44
0x01733e58
0x017882a3
0x017882a3
0x01733e58
0x01733e60
0x01733e6f
0x01733e74
0x01733e77
0x01733e77
0x01733e7a
0x01733e7f
0x01733e8c
0x01733e8c
0x01733e91
0x00000000
0x01733e91

Strings

WindowsExcludedProcs, xrefs: 01733D6F
Kernel-MUI-Language-Disallowed, xrefs: 01733E97
Kernel-MUI-Language-SKU, xrefs: 01733F70
Kernel-MUI-Number-Allowed, xrefs: 01733D8C
Kernel-MUI-Language-Allowed, xrefs: 01733DC0

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: d1450d086018bb218e16f3788cdc5fdb11dba08f2051b2bbe5d1b414fb8a21da
Instruction ID: ba981adc37b42c237cdd7e03a195dd795df4d6d5a354833affd30c5abe50d6cb
Opcode Fuzzy Hash: d1450d086018bb218e16f3788cdc5fdb11dba08f2051b2bbe5d1b414fb8a21da
Instruction Fuzzy Hash: 2CF15E72D40219EFCB26DF98C984AEEFBB9FF58650F54006AE905E7255D7349E00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017FE824 Relevance: 6.5, APIs: 4, Instructions: 493
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E017FE824(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t179;
				unsigned int _t202;
				signed char _t207;
				signed char _t210;
				signed int _t230;
				void* _t244;
				unsigned int _t247;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed char _t293;
				signed char _t295;
				signed char _t298;
				intOrPtr* _t303;
				signed int _t310;
				signed char _t316;
				signed int _t319;
				signed char _t323;
				signed char _t330;
				signed int _t334;
				signed int _t337;
				signed int _t341;
				signed char _t345;
				signed char _t347;
				signed int _t353;
				signed char _t354;
				void* _t383;
				signed char _t385;
				signed char _t386;
				unsigned int _t392;
				signed int _t393;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t401;
				unsigned int _t403;
				void* _t404;
				unsigned int _t405;
				signed int _t406;
				signed char _t412;
				unsigned int _t413;
				unsigned int _t418;
				void* _t419;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				signed char* _t425;
				signed int _t426;
				signed int _t428;
				unsigned int _t430;
				signed int _t431;
				signed int _t433;

				_v8 =  *0x181d360 ^ _t433;
				_v40 = __ecx;
				_v16 = __edx;
				_t289 = 0x4cb2f;
				_t425 = __edx[1];
				_t403 =  *__edx << 2;
				if(_t403 < 8) {
					L3:
					_t404 = _t403 - 1;
					if(_t404 == 0) {
						L16:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						L17:
						_t426 = _v40;
						_v20 = _t426 + 0x1c;
						_t177 = L0174FAD0(_t426 + 0x1c);
						_t385 = 0;
						while(1) {
							L18:
							_t405 =  *(_t426 + 4);
							_t179 = (_t177 | 0xffffffff) << (_t405 & 0x0000001f);
							_t316 = _t289 & _t179;
							_v24 = _t179;
							_v32 = _t316;
							_v12 = _t316 >> 0x18;
							_v36 = _t316 >> 0x10;
							_v28 = _t316 >> 8;
							if(_t385 != 0) {
								goto L21;
							}
							_t418 = _t405 >> 5;
							if(_t418 == 0) {
								_t406 = 0;
								L31:
								if(_t406 == 0) {
									L35:
									E0174FA00(_t289, _t316, _t406, _t426 + 0x1c);
									 *0x181b1e0(0xc +  *_v16 * 4,  *((intOrPtr*)(_t426 + 0x28)));
									_t319 =  *((intOrPtr*)( *((intOrPtr*)(_t426 + 0x20))))();
									_v36 = _t319;
									if(_t319 != 0) {
										asm("stosd");
										asm("stosd");
										asm("stosd");
										_t408 = _v16;
										 *(_t319 + 8) =  *(_t319 + 8) & 0xff000001 | 0x00000001;
										 *((char*)(_t319 + 0xb)) =  *_v16;
										 *(_t319 + 4) = _t289;
										_t53 = _t319 + 0xc; // 0xc
										E01742280(E0176F3E0(_t53,  *((intOrPtr*)(_v16 + 4)),  *_v16 << 2), _v20);
										_t428 = _v40;
										_t386 = 0;
										while(1) {
											L38:
											_t202 =  *(_t428 + 4);
											_v16 = _v16 | 0xffffffff;
											_v16 = _v16 << (_t202 & 0x0000001f);
											_t323 = _v16 & _t289;
											_v20 = _t323;
											_v20 = _v20 >> 0x18;
											_v28 = _t323;
											_v28 = _v28 >> 0x10;
											_v12 = _t323;
											_v12 = _v12 >> 8;
											_v32 = _t323;
											if(_t386 != 0) {
												goto L41;
											}
											_t247 = _t202 >> 5;
											_v24 = _t247;
											if(_t247 == 0) {
												_t412 = 0;
												L50:
												if(_t412 == 0) {
													L53:
													_t291 =  *(_t428 + 4);
													_v28 =  *((intOrPtr*)(_t428 + 0x28));
													_v44 =  *(_t428 + 0x24);
													_v32 =  *((intOrPtr*)(_t428 + 0x20));
													_t207 = _t291 >> 5;
													if( *_t428 < _t207 + _t207) {
														L74:
														_t430 = _t291 >> 5;
														_t293 = _v36;
														_t210 = (_t207 | 0xffffffff) << (_t291 & 0x0000001f) &  *(_t293 + 4);
														_v44 = _t210;
														_t159 = _t430 - 1; // 0xffffffdf
														_t428 = _v40;
														_t330 =  *(_t428 + 8);
														_t386 = _t159 & (_v44 >> 0x00000018) + ((_v44 >> 0x00000010 & 0x000000ff) + ((_t210 >> 0x00000008 & 0x000000ff) + ((_t210 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
														_t412 = _t293;
														 *_t293 =  *(_t330 + _t386 * 4);
														 *(_t330 + _t386 * 4) = _t293;
														 *_t428 =  *_t428 + 1;
														_t289 = 0;
														L75:
														E0173FFB0(_t289, _t412, _t428 + 0x1c);
														if(_t289 != 0) {
															_t428 =  *(_t428 + 0x24);
															 *0x181b1e0(_t289,  *((intOrPtr*)(_t428 + 0x28)));
															 *_t428();
														}
														L77:
														return E0176B640(_t412, _t289, _v8 ^ _t433, _t386, _t412, _t428);
													}
													_t334 = 2;
													_t207 = E0175F3D5( &_v24, _t207 * _t334, _t207 * _t334 >> 0x20);
													if(_t207 < 0) {
														goto L74;
													}
													_t413 = _v24;
													if(_t413 < 4) {
														_t413 = 4;
													}
													 *0x181b1e0(_t413 << 2, _v28);
													_t207 =  *_v32();
													_t386 = _t207;
													_v16 = _t386;
													if(_t386 == 0) {
														_t291 =  *(_t428 + 4);
														if(_t291 >= 0x20) {
															goto L74;
														}
														_t289 = _v36;
														_t412 = 0;
														goto L75;
													} else {
														_t108 = _t413 - 1; // 0x3
														_t337 = _t108;
														if((_t413 & _t337) == 0) {
															L62:
															if(_t413 > 0x4000000) {
																_t413 = 0x4000000;
															}
															_t295 = _t386;
															_v24 = _v24 & 0x00000000;
															_t392 = _t413 << 2;
															_t230 = _t428 | 0x00000001;
															_t393 = _t392 >> 2;
															asm("sbb ecx, ecx");
															_t341 =  !(_v16 + _t392) & _t393;
															if(_t341 <= 0) {
																L67:
																_t395 = (_t393 | 0xffffffff) << ( *(_t428 + 4) & 0x0000001f);
																_v32 = _t395;
																_v20 = 0;
																if(( *(_t428 + 4) & 0xffffffe0) <= 0) {
																	L72:
																	_t345 =  *(_t428 + 8);
																	_t207 = _v16;
																	_t291 =  *(_t428 + 4) & 0x0000001f | _t413 << 0x00000005;
																	 *(_t428 + 8) = _t207;
																	 *(_t428 + 4) = _t291;
																	if(_t345 != 0) {
																		 *0x181b1e0(_t345, _v28);
																		_t207 =  *_v44();
																		_t291 =  *(_t428 + 4);
																	}
																	goto L74;
																} else {
																	goto L68;
																}
																do {
																	L68:
																	_t298 =  *(_t428 + 8);
																	_t431 = _v20;
																	_v12 = _t298;
																	while(1) {
																		_t347 =  *(_t298 + _t431 * 4);
																		_v24 = _t347;
																		if((_t347 & 0x00000001) != 0) {
																			goto L71;
																		}
																		 *(_t298 + _t431 * 4) =  *_t347;
																		_t300 =  *(_t347 + 4) & _t395;
																		_t398 = _v16;
																		_t353 = _t413 - 0x00000001 & (( *(_t347 + 4) & _t395) >> 0x00000018) + ((( *(_t347 + 4) & _t395) >> 0x00000010 & 0x000000ff) + ((( *(_t347 + 4) & _t395) >> 0x00000008 & 0x000000ff) + ((_t300 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																		_t303 = _v24;
																		 *_t303 =  *((intOrPtr*)(_t398 + _t353 * 4));
																		 *((intOrPtr*)(_t398 + _t353 * 4)) = _t303;
																		_t395 = _v32;
																		_t298 = _v12;
																	}
																	L71:
																	_v20 = _t431 + 1;
																	_t428 = _v40;
																} while (_v20 <  *(_t428 + 4) >> 5);
																goto L72;
															} else {
																_t399 = _v24;
																do {
																	_t399 = _t399 + 1;
																	 *_t295 = _t230;
																	_t295 = _t295 + 4;
																} while (_t399 < _t341);
																goto L67;
															}
														}
														_t354 = _t337 | 0xffffffff;
														if(_t413 == 0) {
															L61:
															_t413 = 1 << _t354;
															goto L62;
														} else {
															goto L60;
														}
														do {
															L60:
															_t354 = _t354 + 1;
															_t413 = _t413 >> 1;
														} while (_t413 != 0);
														goto L61;
													}
												}
												_t89 = _t412 + 8; // 0x8
												_t244 = E017FE7A8(_t89);
												_t289 = _v36;
												if(_t244 == 0) {
													_t412 = 0;
												}
												goto L75;
											}
											_t386 =  *(_t428 + 8) + (_v24 - 0x00000001 & (_v20 & 0x000000ff) + 0x164b2f3f + (((_t323 & 0x000000ff) * 0x00000025 + (_v12 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
											_t323 = _v32;
											while(1) {
												L41:
												_t386 =  *_t386;
												_v12 = _t386;
												if((_t386 & 0x00000001) != 0) {
													break;
												}
												if(_t323 == ( *(_t386 + 4) & _v16)) {
													L45:
													if(_t386 == 0) {
														goto L53;
													}
													if(E017FE7EB(_t386, _t408) != 0) {
														_t412 = _v12;
														goto L50;
													}
													_t386 = _v12;
													goto L38;
												}
											}
											_t386 = 0;
											_v12 = 0;
											goto L45;
										}
									}
									_t412 = 0;
									goto L77;
								}
								_t38 = _t406 + 8; // 0x8
								_t364 = _t38;
								if(E017FE7A8(_t38) == 0) {
									_t406 = 0;
								}
								E0174FA00(_t289, _t364, _t406, _v20);
								goto L77;
							}
							_t24 = _t418 - 1; // -1
							_t385 =  *((intOrPtr*)(_t426 + 8)) + (_t24 & (_v12 & 0x000000ff) + 0x164b2f3f + (((_t316 & 0x000000ff) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025 + (_v36 & 0x000000ff)) * 0x00000025) * 4;
							_t316 = _v32;
							L21:
							_t406 = _v24;
							while(1) {
								_t385 =  *_t385;
								_v12 = _t385;
								if((_t385 & 0x00000001) != 0) {
									break;
								}
								if(_t316 == ( *(_t385 + 4) & _t406)) {
									L26:
									if(_t385 == 0) {
										goto L35;
									}
									_t177 = E017FE7EB(_t385, _v16);
									if(_t177 != 0) {
										_t406 = _v12;
										goto L31;
									}
									_t385 = _v12;
									goto L18;
								}
							}
							_t385 = 0;
							_v12 = 0;
							goto L26;
						}
					}
					_t419 = _t404 - 1;
					if(_t419 == 0) {
						L15:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L16;
					}
					_t420 = _t419 - 1;
					if(_t420 == 0) {
						L14:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L15;
					}
					_t421 = _t420 - 1;
					if(_t421 == 0) {
						L13:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L14;
					}
					_t422 = _t421 - 1;
					if(_t422 == 0) {
						L12:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L13;
					}
					_t423 = _t422 - 1;
					if(_t423 == 0) {
						L11:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L12;
					}
					if(_t423 != 1) {
						goto L17;
					} else {
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L11;
					}
				} else {
					_t401 = _t403 >> 3;
					_t403 = _t403 + _t401 * 0xfffffff8;
					do {
						_t383 = ((((((_t425[1] & 0x000000ff) * 0x25 + (_t425[2] & 0x000000ff)) * 0x25 + (_t425[3] & 0x000000ff)) * 0x25 + (_t425[4] & 0x000000ff)) * 0x25 + (_t425[5] & 0x000000ff)) * 0x25 + (_t425[6] & 0x000000ff)) * 0x25 - _t289 * 0x2fe8ed1f;
						_t310 = ( *_t425 & 0x000000ff) * 0x1a617d0d;
						_t288 = _t425[7] & 0x000000ff;
						_t425 =  &(_t425[8]);
						_t289 = _t310 + _t383 + _t288;
						_t401 = _t401 - 1;
					} while (_t401 != 0);
					goto L3;
				}
			}

0x017fe833
0x017fe839
0x017fe83e
0x017fe841
0x017fe848
0x017fe84b
0x017fe851
0x017fe8b2
0x017fe8b2
0x017fe8b5
0x017fe90b
0x017fe911
0x017fe913
0x017fe913
0x017fe91a
0x017fe91d
0x017fe922
0x017fe924
0x017fe924
0x017fe924
0x017fe92f
0x017fe933
0x017fe935
0x017fe93a
0x017fe940
0x017fe948
0x017fe950
0x017fe955
0x00000000
0x00000000
0x017fe957
0x017fe95c
0x017fe9cb
0x017fe9d2
0x017fe9d4
0x017fe9f2
0x017fe9f6
0x017fea10
0x017fea18
0x017fea1a
0x017fea1f
0x017fea2c
0x017fea2d
0x017fea2e
0x017fea32
0x017fea3d
0x017fea42
0x017fea45
0x017fea51
0x017fea60
0x017fea65
0x017fea68
0x017fea6a
0x017fea6a
0x017fea6a
0x017fea6f
0x017fea76
0x017fea7c
0x017fea7e
0x017fea81
0x017fea85
0x017fea88
0x017fea8c
0x017fea8f
0x017fea93
0x017fea98
0x00000000
0x00000000
0x017fea9a
0x017fea9d
0x017feaa2
0x017feb0e
0x017feb15
0x017feb17
0x017feb33
0x017feb36
0x017feb39
0x017feb3f
0x017feb45
0x017feb4a
0x017feb52
0x017fecb1
0x017fecb9
0x017fecbe
0x017fecc3
0x017fecc6
0x017feceb
0x017fecee
0x017fecf9
0x017fecfe
0x017fed00
0x017fed05
0x017fed07
0x017fed0a
0x017fed0c
0x017fed0e
0x017fed12
0x017fed19
0x017fed1e
0x017fed24
0x017fed2a
0x017fed2a
0x017fed2c
0x017fed3e
0x017fed3e
0x017feb5a
0x017feb62
0x017feb69
0x00000000
0x00000000
0x017feb6f
0x017feb75
0x017feb79
0x017feb79
0x017feb88
0x017feb8e
0x017feb90
0x017feb92
0x017feb97
0x017fed3f
0x017fed45
0x00000000
0x00000000
0x017fed4b
0x017fed4e
0x00000000
0x017feb9d
0x017feb9d
0x017feb9d
0x017feba2
0x017febb5
0x017febbc
0x017febbe
0x017febbe
0x017febc3
0x017febc5
0x017febcb
0x017febd2
0x017febd5
0x017febdb
0x017febdf
0x017febe1
0x017febf0
0x017febf9
0x017fec04
0x017fec07
0x017fec0a
0x017fec82
0x017fec85
0x017fec8b
0x017fec91
0x017fec93
0x017fec96
0x017fec9b
0x017feca6
0x017fecac
0x017fecae
0x017fecae
0x00000000
0x00000000
0x00000000
0x00000000
0x017fec0c
0x017fec0c
0x017fec0c
0x017fec0f
0x017fec12
0x017fec15
0x017fec15
0x017fec18
0x017fec1e
0x00000000
0x00000000
0x017fec22
0x017fec28
0x017fec4b
0x017fec5b
0x017fec5d
0x017fec63
0x017fec65
0x017fec68
0x017fec6b
0x017fec6b
0x017fec70
0x017fec71
0x017fec74
0x017fec7d
0x00000000
0x017febe3
0x017febe3
0x017febe6
0x017febe6
0x017febe7
0x017febe9
0x017febec
0x00000000
0x017febe6
0x017febe1
0x017feba4
0x017feba9
0x017febb0
0x017febb3
0x00000000
0x00000000
0x00000000
0x00000000
0x017febab
0x017febab
0x017febab
0x017febac
0x017febac
0x00000000
0x017febab
0x017feb97
0x017feb19
0x017feb1c
0x017feb21
0x017feb26
0x017feb2c
0x017feb2c
0x00000000
0x017feb26
0x017fead6
0x017fead9
0x017feadc
0x017feadc
0x017feadc
0x017feade
0x017feae4
0x00000000
0x00000000
0x017feaee
0x017feaf7
0x017feaf9
0x00000000
0x00000000
0x017feb04
0x017feb12
0x00000000
0x017feb12
0x017feb06
0x00000000
0x017feb06
0x017feaf0
0x017feaf2
0x017feaf4
0x00000000
0x017feaf4
0x017fea6a
0x017fea21
0x00000000
0x017fea21
0x017fe9d6
0x017fe9d6
0x017fe9e0
0x017fe9e2
0x017fe9e2
0x017fe9e8
0x00000000
0x017fe9e8
0x017fe987
0x017fe98f
0x017fe992
0x017fe995
0x017fe995
0x017fe998
0x017fe998
0x017fe99a
0x017fe9a0
0x00000000
0x00000000
0x017fe9a9
0x017fe9b2
0x017fe9b4
0x00000000
0x00000000
0x017fe9ba
0x017fe9c1
0x017fe9cf
0x00000000
0x017fe9cf
0x017fe9c3
0x00000000
0x017fe9c3
0x017fe9ab
0x017fe9ad
0x017fe9af
0x00000000
0x017fe9af
0x017fe924
0x017fe8b7
0x017fe8ba
0x017fe902
0x017fe908
0x017fe90a
0x00000000
0x017fe90a
0x017fe8bc
0x017fe8bf
0x017fe8f9
0x017fe8ff
0x017fe901
0x00000000
0x017fe901
0x017fe8c1
0x017fe8c4
0x017fe8f0
0x017fe8f6
0x017fe8f8
0x00000000
0x017fe8f8
0x017fe8c6
0x017fe8c9
0x017fe8e7
0x017fe8ed
0x017fe8ef
0x00000000
0x017fe8ef
0x017fe8cb
0x017fe8ce
0x017fe8de
0x017fe8e4
0x017fe8e6
0x00000000
0x017fe8e6
0x017fe8d3
0x00000000
0x017fe8d5
0x017fe8db
0x017fe8dd
0x00000000
0x017fe8dd
0x017fe853
0x017fe855
0x017fe85b
0x017fe85d
0x017fe897
0x017fe89c
0x017fe8a2
0x017fe8a6
0x017fe8ab
0x017fe8ad
0x017fe8ad
0x00000000
0x017fe85d

APIs

RtlDebugPrintTimes.NTDLL ref: 017FEA10
RtlDebugPrintTimes.NTDLL ref: 017FED24

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 8138b90a632b0d3b50ba80f5afa97b6e5e8944507cd6f41263d71efaff69772d
Instruction ID: 4a9a2a5fda97b710165b0d28a5a0b7c456e09eba7b1b52d04c386d255271187e
Opcode Fuzzy Hash: 8138b90a632b0d3b50ba80f5afa97b6e5e8944507cd6f41263d71efaff69772d
Instruction Fuzzy Hash: BF02A272E006168FCB18CF6DC89167EFBF6AF88200B1A816DD556DB395DB34EA41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017240E1 Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E017240E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E0172B150();
					} else {
						E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0172B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E0172B150(", passed to %s", _t29);
					}
					_push("\n");
					E0172B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x1816378 = 1;
						asm("int3");
						 *0x1816378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x017240e6
0x017240e8
0x017240f1
0x0178042d
0x0178044c
0x01780451
0x0178042f
0x01780444
0x01780449
0x0178045d
0x01780466
0x0178046e
0x01780474
0x01780475
0x0178047a
0x0178048a
0x0178048c
0x01780493
0x01780494
0x01780494
0x00000000
0x0178049b
0x00000000

Strings

Invalid heap signature for heap at %p, xrefs: 01780458
RtlAllocateHeap, xrefs: 01780468
, passed to %s, xrefs: 01780469
HEAP: , xrefs: 0178044C
HEAP[%wZ]: , xrefs: 0178043F

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: 1acc983de76b0a7efbeab537e43349b8665af6378733325991f3526afe67e192
Instruction ID: 38bf3a6ea6f0b46a562bc98532b823fa05d94f221e13cd9eca3084a94c9f0abc
Opcode Fuzzy Hash: 1acc983de76b0a7efbeab537e43349b8665af6378733325991f3526afe67e192
Instruction Fuzzy Hash: 7F014C72180751DED326A76DE46DF52FBE4DB01F30F39406EF00947681CAE49485C720

Uniqueness

Uniqueness Score: -1.00%

Function 0174A830 Relevance: 5.4, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E0174A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x1818748 - 1;
					if( *0x1818748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E0172B150();
									_t260 = _t257 + 4;
								} else {
									E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E0172B150();
								_t257 = _t260 + 4;
								__eflags =  *0x1817bc8;
								if(__eflags == 0) {
									E017E2073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E017EA80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E0177D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E0174AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E017EA80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E017EA80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x1818748 - 1;
					if( *0x1818748 >= 1) {
						_t127 = _t256 + 0xfff; // 0xfff
						_t131 = _t127 & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E0172B150();
							} else {
								E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E0172B150();
							__eflags =  *0x1817bc8;
							if(__eflags == 0) {
								_t131 = E017E2073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x0174a83a
0x0174a83c
0x0174a83e
0x0174a841
0x0174a844
0x0174a84a
0x0174aa53
0x0174aa59
0x0174aa59
0x0174a858
0x0174a85e
0x0174aaf5
0x0174aafc
0x0179229e
0x017922a2
0x017922a8
0x017922b3
0x017922b5
0x017922bb
0x017922c1
0x017922c5
0x017922e6
0x017922eb
0x017922f0
0x017922c7
0x017922dc
0x017922e1
0x017922e1
0x017922f3
0x017922f8
0x017922fd
0x01792300
0x01792307
0x0179230e
0x0179230e
0x01792313
0x01792313
0x017922b5
0x017922a2
0x0174aafc
0x0174a864
0x0174a869
0x0174aa5c
0x0174aa5e
0x0174a86f
0x0174a87f
0x0174a885
0x0174a885
0x0174a88b
0x0174a890
0x0174a896
0x0174ab0c
0x0174ab0f
0x0174ab15
0x01792320
0x01792320
0x0174ab1b
0x0174a89c
0x0174a89f
0x0174a8a2
0x0174a8a2
0x0174a8a5
0x0174a8af
0x0174a8b3
0x0174a8b8
0x0174aa66
0x0174a8be
0x0174a8c5
0x0174a8c6
0x0174a8ce
0x01792328
0x01792332
0x01792337
0x01792337
0x0174a8ce
0x0174a8d4
0x0174a8d8
0x0174a8db
0x0174a8de
0x0174a8e1
0x0174a8e5
0x0174a8e8
0x0174a8f0
0x0174a8f3
0x0179234c
0x01792350
0x01792355
0x01792359
0x01792359
0x0174a8f9
0x0174a901
0x0174aae4
0x0174aae4
0x0174aaea
0x00000000
0x0174a907
0x0174a90a
0x0174a91d
0x0174a91d
0x00000000
0x0174a910
0x0174a910
0x0174a910
0x0174a914
0x0174a924
0x0174a924
0x0174a924
0x0174a924
0x0174a916
0x0174a91b
0x00000000
0x00000000
0x00000000
0x0174a91b
0x0174a925
0x0174a925
0x0174a932
0x0174a936
0x0174a93c
0x0174a93c
0x0174a93c
0x0174ab22
0x0174ab24
0x0174ab27
0x0174ab27
0x0174a942
0x0174a944
0x0174aaba
0x0174aabd
0x0174aac0
0x0174aac0
0x0174aac2
0x0174ab2f
0x0174aac4
0x0174aac4
0x0174aac7
0x0174aaca
0x0174aacc
0x0174aace
0x0174aace
0x0174aace
0x0174aad1
0x0174aad1
0x0174aad7
0x0174aad9
0x00000000
0x00000000
0x01792361
0x01792369
0x0179236b
0x00000000
0x01792371
0x00000000
0x01792371
0x00000000
0x0179236b
0x0174aac0
0x0174a94a
0x0174a94a
0x0174a94d
0x0174a94d
0x0174a950
0x0174a954
0x01792376
0x01792380
0x0174a95a
0x0174a95a
0x0174a95c
0x0174a95f
0x0174a961
0x0174a961
0x0174a967
0x0174a96a
0x0174a972
0x0174aa02
0x0174aa06
0x0174aa10
0x0174aa16
0x0174aa16
0x0174aa1b
0x0174aa21
0x0174aa24
0x0174aa27
0x0174aa29
0x0174aa2c
0x0174aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x0174a978
0x0174a978
0x0174a97b
0x0174a981
0x0174a996
0x0174a998
0x0174a99f
0x0174a9a2
0x0179238a
0x0174a9a8
0x0174a9a8
0x0174a9a8
0x0174a9aa
0x0174a9ad
0x0174a9b0
0x0174a9bb
0x0174a9be
0x0174a9c7
0x0174a9c9
0x0174a9c9
0x0174a9cc
0x0174a9d1
0x0174aa6d
0x0174aa70
0x0174aa73
0x0174aa75
0x0174aa79
0x0174aa7e
0x0174aa82
0x0174aa8f
0x0174aa94
0x0174aa96
0x01792392
0x017923a1
0x017923a1
0x0174aa9c
0x0174aa9f
0x0174aaa2
0x0174aaa2
0x0174aaa8
0x0174aaab
0x0174aaaf
0x00000000
0x0174aab5
0x00000000
0x0174aab5
0x0174a9d7
0x0174a9d7
0x0174a9da
0x0174a9e0
0x0174a9e3
0x0174a9e6
0x0174a9e9
0x0174a9eb
0x0174a9fd
0x0174a9fd
0x00000000
0x0174a9eb
0x00000000
0x00000000
0x00000000
0x0174a983
0x0174a983
0x0174a983
0x0174a987
0x0174a995
0x0174a995
0x0174a995
0x0174a995
0x0174a989
0x0174a98e
0x00000000
0x0174a990
0x00000000
0x0174a990
0x0174a98e
0x00000000
0x0174a983
0x0174a972
0x0174a90a
0x0174aa34
0x0174aa34
0x0174aa40
0x0174aa43
0x0174aa46
0x0174aa4d
0x017923ab
0x017923b2
0x017923b8
0x017923be
0x017923c3
0x017923c5
0x017923cb
0x017923d1
0x017923d5
0x017923f6
0x017923fb
0x017923d7
0x017923ec
0x017923f1
0x01792403
0x01792408
0x01792410
0x01792417
0x01792422
0x01792422
0x01792417
0x017923c5
0x017923b2
0x00000000

Strings

ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 01792403
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 017922F3
HEAP: , xrefs: 017922E6, 017923F6
HEAP[%wZ]: , xrefs: 017922D7, 017923E7

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: b03a9a582a6f6348e9329524b8ff42fcec3bb4910e2252de3360135f14e61551
Instruction ID: c0bddfc16f6bb0ad1bd0054bbabdf4d672a18be7f87e93ff3223704f7acabfa7
Opcode Fuzzy Hash: b03a9a582a6f6348e9329524b8ff42fcec3bb4910e2252de3360135f14e61551
Instruction Fuzzy Hash: 91D1EF74A402469FEB19CF68C494BBAFBF1FF48300F1585A9D99A9B346E330A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0174A229 Relevance: 5.2, Strings: 4, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0174A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E0174DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E01769730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E017EA80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E01769660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E0172B150();
					} else {
						E0172B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E0172B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E01747D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E017E138A(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E01747D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E01747D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E017E1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E01747D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E01747D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E017E1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E0177D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x0174a229
0x0174a231
0x0174a23f
0x0174a242
0x0174a244
0x0174a24c
0x0174a255
0x0174a25a
0x0174a25f
0x01791c76
0x01791c78
0x01791c7e
0x01791c7f
0x01791c81
0x01791c82
0x01791c84
0x01791c89
0x01791c8b
0x01791c9e
0x01791c9e
0x01791cab
0x01791cb2
0x00000000
0x01791cb2
0x01791c8d
0x01791c92
0x00000000
0x00000000
0x01791c94
0x01791c98
0x00000000
0x00000000
0x00000000
0x01791c98
0x0174a265
0x0174a265
0x0174a266
0x0174a26f
0x0174a270
0x0174a276
0x0174a277
0x0174a279
0x0174a27e
0x0174a282
0x01791db5
0x01791dbb
0x01791dc1
0x01791dc5
0x01791de4
0x01791de9
0x01791dc7
0x01791ddc
0x01791de1
0x01791def
0x01791df3
0x01791df7
0x01791dfe
0x01791e06
0x0174a302
0x0174a308
0x0174a308
0x0174a288
0x0174a28d
0x0174a294
0x01791cc1
0x0174a29a
0x0174a29a
0x0174a29a
0x0174a29f
0x01791ccb
0x01791cd1
0x01791cd8
0x01791cea
0x01791cea
0x01791cd8
0x0174a2a9
0x0174a2af
0x0174a2bc
0x01791cfd
0x0174a2c2
0x0174a2c2
0x0174a2c2
0x0174a2c7
0x01791d07
0x01791d0d
0x01791d14
0x01791d1f
0x01791d21
0x01791d2c
0x01791d2c
0x01791d2c
0x01791d47
0x01791d47
0x01791d14
0x0174a2cd
0x0174a2d2
0x0174a2d9
0x01791d5a
0x0174a2df
0x0174a2df
0x0174a2df
0x0174a2e4
0x01791d69
0x01791d6b
0x01791d76
0x01791d76
0x01791d76
0x01791d91
0x01791d91
0x0174a2ea
0x0174a2f0
0x0174a2f5
0x01791da8
0x01791dad
0x01791dad
0x0174a2fd
0x0174a300
0x00000000

Strings

`, xrefs: 01791C8D
HEAP: , xrefs: 01791DE4
HEAP[%wZ]: , xrefs: 01791DD7
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 01791DF9

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: baf657f41699d4f099c66c955ffcd9fb140ef6708adabb05da066e64a4a42f5f
Instruction ID: 47986eeb9242735f34fc9b8055be5b1704bf5da55541c4b73b29f50c757dbcbc
Opcode Fuzzy Hash: baf657f41699d4f099c66c955ffcd9fb140ef6708adabb05da066e64a4a42f5f
Instruction Fuzzy Hash: EA5138322446829FD722DB68D848F67F7E8FF84760F190868F952CB291D734D844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 017E49A4 Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 017E4A61
This is located in the %s field of the heap header., xrefs: 017E4AD6
HEAP: , xrefs: 017E4A4A, 017E4A5D, 017E4A5F, 017E4AC4
HEAP[%wZ]: , xrefs: 017E4A3D, 017E4AB7

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: d1c015b479ca0dbc266340da7a6d7214da3308a74ed3c898d1ae65e5feec26df
Instruction ID: 641277983edce69192b34c6169fa10320e59c1c93d0e5f7d69fd4d671404eb28
Opcode Fuzzy Hash: d1c015b479ca0dbc266340da7a6d7214da3308a74ed3c898d1ae65e5feec26df
Instruction Fuzzy Hash: A131CE71200214EFD722DB9DC89DF67F7E8EB08630F24415AF506DB291DA70EA84CB69

Uniqueness

Uniqueness Score: -1.00%

Function 01738794 Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E01738794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0173934A() != 0) {
								_t159 = E017AA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x1815780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E017A5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x1815780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0173849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E01738999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E01738999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x1815c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x1815c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E01742280(_t92, 0x18186cc);
															_t94 = E017F9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E017561A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x1815c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E01738A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x1815c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x1815c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E0176F380(_t136, 0x1701184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E01742280(_t108, 0x18186cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E017561A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E017F9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0173FFB0(_t118, _t156, 0x18186cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E01769A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x01738799
0x0173879d
0x017387a1
0x017387a3
0x017387a8
0x017387c3
0x017387c3
0x017387c8
0x017387d1
0x017387d4
0x017387d8
0x017387e5
0x017387ec
0x01789bfe
0x01789c00
0x01789c02
0x01789c08
0x01789c0d
0x01789c0f
0x01789c14
0x01789c2d
0x01789c32
0x01789c37
0x01789c3a
0x01789c3c
0x01789c42
0x01789c42
0x01789c3c
0x01789c02
0x017387da
0x017387df
0x017387e3
0x00000000
0x00000000
0x017387e3
0x017387f2
0x00000000
0x017387fb
0x017387fd
0x017387fe
0x0173880e
0x0173880f
0x01738810
0x01738814
0x0173881a
0x0173881c
0x0173881f
0x01738821
0x01738822
0x01738824
0x01738826
0x0173882c
0x0173882e
0x01789c48
0x01789c48
0x01738834
0x01738834
0x01738837
0x00000000
0x00000000
0x01738837
0x0173882e
0x0173883d
0x01738840
0x01738843
0x01738846
0x01738849
0x0173884c
0x0173884e
0x01738850
0x01738852
0x01738854
0x01738857
0x017388b4
0x017388b6
0x017388b6
0x01738859
0x01738859
0x01738859
0x01738861
0x01738866
0x0173886a
0x0173893d
0x01738941
0x00000000
0x01738947
0x01738947
0x0173894a
0x0173894c
0x00000000
0x01738952
0x01738955
0x0173895a
0x0173895d
0x0173895d
0x0173895f
0x01738961
0x01738961
0x01738968
0x00000000
0x00000000
0x0173896a
0x0173896b
0x0173896e
0x00000000
0x01738970
0x01738970
0x01738970
0x01738970
0x01738972
0x01738972
0x01738974
0x00000000
0x0173897a
0x0173897a
0x0173897d
0x00000000
0x01738983
0x01789c65
0x01789c6d
0x01789c72
0x01789c75
0x01789c75
0x01789c82
0x01789c86
0x01789c87
0x01789c88
0x01789c89
0x01789c8c
0x01789c90
0x01789c95
0x01789c97
0x01789ca0
0x01789ca3
0x01789ca9
0x01789ca9
0x00000000
0x01789ca9
0x01789ca3
0x00000000
0x01789c97
0x0173897d
0x00000000
0x01738974
0x01738988
0x01738992
0x01738996
0x00000000
0x01738996
0x0173894c
0x00000000
0x01738870
0x0173887b
0x0173887d
0x0173887f
0x01738881
0x01738884
0x01738884
0x01738886
0x01738889
0x0173888c
0x0173888e
0x01738891
0x01738891
0x01738898
0x00000000
0x00000000
0x0173889a
0x0173889b
0x0173889e
0x00000000
0x00000000
0x017388a0
0x017388a8
0x017388b0
0x017388b2
0x017388d3
0x017388d5
0x00000000
0x017388d7
0x017388db
0x017388dc
0x017388e0
0x017388e8
0x017388ee
0x017388f0
0x017388f3
0x017388fc
0x01738901
0x01738906
0x0173890c
0x0173890c
0x0173890f
0x01738916
0x01738917
0x01738918
0x01738919
0x0173891a
0x0173891f
0x01738921
0x01789c52
0x01789c55
0x01789c5b
0x01789cac
0x01789cc0
0x01789cc0
0x01789c55
0x01738927
0x01738927
0x0173892f
0x01738933
0x00000000
0x017388f5
0x017388f5
0x00000000
0x017388f7
0x017388f7
0x017388fa
0x00000000
0x00000000
0x00000000
0x00000000
0x017388fa
0x017388f5
0x017388f3
0x00000000
0x017388d5
0x00000000
0x017388b2
0x017388c9
0x00000000
0x017388c9
0x0173887f
0x0173886a
0x01738857
0x01738852
0x017388bf
0x017388bf
0x017387aa
0x017387ad
0x017387ae
0x017387b4
0x017387b5
0x017387b6
0x017387b8
0x017387bd
0x017387c1
0x017387f4
0x017387fa
0x00000000
0x00000000
0x00000000
0x017387c1
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 01789C28
LdrpDoPostSnapWork, xrefs: 01789C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 01789C18

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 733d2f8ae26618244daf3ac2375e6229db5e9d2b2828079f87c374743b87bb9a
Instruction ID: c53ee52efc39e108b2328156008a104877adb132944a28854896bf7f3b48809d
Opcode Fuzzy Hash: 733d2f8ae26618244daf3ac2375e6229db5e9d2b2828079f87c374743b87bb9a
Instruction Fuzzy Hash: 2191F471A0020ADFDB19DF59D881ABAF7B5FFC4314B554269FA01AB246D730EA01CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01737E41 Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E01737E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0173CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0172C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x1815780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E017A5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x1815780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E01747D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01747D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E017A7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E01747D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01747D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E017A7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0175A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0172B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x01737e4c
0x01737e50
0x01737e55
0x01737e58
0x01737e5d
0x01737e71
0x01737f33
0x01737e77
0x01737e77
0x01737e79
0x01737e79
0x01737e7e
0x01737f45
0x01789848
0x00000000
0x01789848
0x01737f4e
0x01737f53
0x01737f5a
0x00000000
0x00000000
0x0178985a
0x01789862
0x01789866
0x00000000
0x0178986c
0x00000000
0x0178986c
0x01737e84
0x01737e84
0x01737e8d
0x01789871
0x01737eb8
0x01737ec0
0x01737ec0
0x01737e9a
0x0178987e
0x00000000
0x00000000
0x01789884
0x0178988b
0x017898a7
0x017898ac
0x017898b1
0x017898b6
0x017898b8
0x017898b8
0x017898b9
0x00000000
0x017898b9
0x01737ea0
0x01737ea7
0x00000000
0x00000000
0x01737eac
0x01737eb1
0x01737ec6
0x01737ed0
0x017898cc
0x01737ed6
0x01737ed6
0x01737ed6
0x01737ede
0x01737ee3
0x017898e3
0x017898f0
0x01789902
0x017898f2
0x017898fb
0x017898fb
0x01789907
0x0178991d
0x0178991d
0x01789907
0x017898e3
0x01737ef0
0x01737f14
0x01737f14
0x01737f1e
0x01789946
0x01737f24
0x01737f24
0x01737f24
0x01737f2c
0x0178996a
0x01789975
0x01789975
0x0178997e
0x01789993
0x01789993
0x0178997e
0x00000000
0x01737ef2
0x01737efc
0x01737f0a
0x01737f0e
0x01789933
0x00000000
0x01789933
0x00000000
0x01737f0e
0x00000000
0x00000000
0x00000000
0x01737eb1

Strings

Could not validate the crypto signature for DLL %wZ, xrefs: 01789891
minkernel\ntdll\ldrmap.c, xrefs: 017898A2
LdrpCompleteMapModule, xrefs: 01789898

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 76a1d9f8455d8ea655b9dad2a7b4f965517e7abf225373188cb9e37346ffccca
Instruction ID: 1fb4433ee93a5c9b84ad40e33a6c58244481508032c00146cdd66cc0574fd428
Opcode Fuzzy Hash: 76a1d9f8455d8ea655b9dad2a7b4f965517e7abf225373188cb9e37346ffccca
Instruction Fuzzy Hash: 3C5104B1684746DBE72ADB5CC944B2AFBE4BBC8314F140699EA519B7D2D730ED00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0172E620 Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0172E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0172F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E017695D0();
						}
						if(_t78 != 0) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E0176FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E0176BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E01769600();
					if(_t97 < 0) {
						goto L6;
					}
					E0176BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0172F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E0176BB40(_t83, _t102 + 0x24, _t78);
								if(L017343C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E0176BB40(_t84, _t102 + 0x24, _t94);
									if(L017343C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x0172e620
0x0172e628
0x0172e62f
0x0172e631
0x0172e635
0x0172e637
0x0172e63e
0x01785503
0x01785503
0x0172e64c
0x0172e64c
0x0172e651
0x00000000
0x00000000
0x0172e661
0x0172e665
0x0178542a
0x0172e715
0x0172e71a
0x0172e71c
0x0172e720
0x0172e720
0x0172e727
0x0172e736
0x0172e736
0x0172e743
0x0172e743
0x0172e673
0x0172e678
0x0172e67d
0x0172e682
0x0172e685
0x0172e692
0x0172e69b
0x0172e6a3
0x0172e6ad
0x0172e6b1
0x0172e6b2
0x0172e6bb
0x0172e6bf
0x0172e6c0
0x0172e6c8
0x0172e6cc
0x0172e6d5
0x0172e6d9
0x00000000
0x00000000
0x0172e6e5
0x0172e6ea
0x0172e6f9
0x0172e70b
0x0172e70f
0x01785439
0x0178545e
0x0178545e
0x00000000
0x0178545e
0x0178543b
0x0178543e
0x01785440
0x01785445
0x01785472
0x01785475
0x0178548d
0x01785493
0x017854a9
0x00000000
0x00000000
0x017854ab
0x017854b4
0x017854bc
0x017854c8
0x017854de
0x017854fb
0x017854e0
0x017854e6
0x017854eb
0x017854eb
0x017854de
0x00000000
0x017854bc
0x01785477
0x0178547a
0x01785480
0x01785483
0x01785486
0x0178548b
0x00000000
0x00000000
0x00000000
0x0178548b
0x00000000
0x00000000
0x00000000
0x00000000
0x01785447
0x01785447
0x01785447
0x01785447
0x0178544e
0x00000000
0x00000000
0x01785450
0x01785452
0x01785455
0x0178545a
0x00000000
0x00000000
0x00000000
0x0178545c
0x0178546a
0x0178546d
0x0178546f
0x00000000
0x0178546f
0x0172e70f

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0172E68C
InstallLanguageFallback, xrefs: 0172E6DB
@, xrefs: 0172E6C0

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: b8267276928758123b9b71452fd08c618c7c9fd626f711dfd67e1b444a3c4bff
Instruction ID: 5bd25d1347417c89b9c973ddf6ae836c7ef6c70e2d132653085aee179f4a35d8
Opcode Fuzzy Hash: b8267276928758123b9b71452fd08c618c7c9fd626f711dfd67e1b444a3c4bff
Instruction Fuzzy Hash: D251E6726043169BD724EF28C444A6BF7E8BF98714F04096EFA89D7240FB34D905C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 017BFF10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 017BFF9A

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 017BFF60

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 3446177414-1911121157
Opcode ID: aa8d9c5fe0cddfc69bdba9423120a4bd2ef836a2eb5cf3734ddb0d0922666bbf
Instruction ID: 2c1521c21222f868fd20e63093033db7b3cc05f048785ad4d2f93e710ee04067
Opcode Fuzzy Hash: aa8d9c5fe0cddfc69bdba9423120a4bd2ef836a2eb5cf3734ddb0d0922666bbf
Instruction Fuzzy Hash: BC118B72910148AFDF22EB54CD89FD8FBB1FF09B04F158054F608AB2A5C7799A40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017EE539 Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E017EE539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E017EBBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E017EBCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E017EAFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E01769730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E017EA80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E017EA854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E01769730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E017EA80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E017EA854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E01742280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E0173B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E0173FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E01747D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E017DFEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x017ee547
0x017ee549
0x017ee54f
0x017ee553
0x017ee557
0x017ee55a
0x017ee55c
0x017ee55f
0x017ee561
0x017ee567
0x017ee56b
0x017ee7e2
0x00000000
0x017ee571
0x017ee575
0x017ee577
0x017ee57b
0x017ee57c
0x017ee57d
0x017ee57e
0x017ee57f
0x017ee588
0x017ee58f
0x017ee591
0x017ee592
0x017ee592
0x017ee596
0x017ee59e
0x017ee5a0
0x017ee5a6
0x017ee61d
0x017ee61d
0x017ee621
0x017ee623
0x017ee630
0x017ee630
0x017ee7e6
0x017ee7eb
0x017ee7ed
0x017ee7f4
0x017ee7fa
0x017ee7ff
0x017ee7ff
0x017ee80a
0x017ee812
0x017ee812
0x017ee5ab
0x017ee5b4
0x017ee5b9
0x017ee5be
0x017ee5c0
0x017ee5c2
0x017ee5c8
0x017ee5c9
0x017ee5cb
0x017ee5cc
0x017ee5d5
0x017ee5e4
0x017ee5f1
0x017ee5f8
0x017ee5f8
0x017ee5d5
0x017ee602
0x017ee616
0x017ee63d
0x017ee644
0x017ee64d
0x017ee652
0x017ee657
0x017ee659
0x017ee65b
0x017ee661
0x017ee662
0x017ee664
0x017ee665
0x017ee66e
0x017ee67d
0x017ee68a
0x017ee691
0x017ee691
0x017ee66e
0x017ee6b0
0x00000000
0x017ee6b6
0x017ee6bd
0x017ee6c7
0x017ee6d7
0x017ee6d9
0x017ee6db
0x017ee6de
0x017ee6e3
0x017ee6f3
0x017ee6fc
0x017ee700
0x017ee700
0x017ee704
0x017ee70a
0x017ee70a
0x017ee713
0x017ee716
0x017ee719
0x017ee720
0x017ee761
0x017ee76b
0x017ee774
0x017ee77a
0x017ee77a
0x017ee78a
0x017ee791
0x017ee799
0x017ee79b
0x017ee79f
0x017ee7aa
0x017ee7c0
0x017ee7ac
0x017ee7b2
0x017ee7b9
0x017ee7b9
0x017ee7c7
0x017ee806
0x00000000
0x017ee7c9
0x017ee7d1
0x017ee7d8
0x00000000
0x017ee7d8
0x00000000
0x00000000
0x017ee722
0x017ee72e
0x017ee748
0x017ee74c
0x017ee754
0x017ee756
0x017ee75c
0x017ee75c
0x00000000
0x017ee75c
0x017ee758
0x017ee758
0x00000000
0x017ee758
0x017ee750
0x00000000
0x00000000
0x017ee752
0x00000000
0x017ee752
0x017ee730
0x017ee735
0x017ee73d
0x017ee73f
0x00000000
0x00000000
0x017ee741
0x017ee741
0x00000000
0x017ee741
0x017ee739
0x00000000
0x00000000
0x017ee73b
0x00000000
0x017ee73b
0x017ee722
0x017ee720
0x017ee6b0
0x017ee618
0x00000000
0x017ee618

Strings

`, xrefs: 017EE670
`, xrefs: 017EE5D7

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: b8ddd5df007e8a7c37fc079c442627336aad1bb282b2246d2dc159a307d5c258
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: A6918F312443429FE725CE29C849B1BFBE5AF88714F148D2DFA95CB290EB74E904CB52

Uniqueness

Uniqueness Score: -1.00%

Function 017A51BE Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E017A51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x18005f0);
				E0177D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0173EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E017A53CA(0);
						return E0177D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E0176F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E01743690(1, _t117, 0x1701810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E0176AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L01744620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E0176AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E017A500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E01769860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x017a51be
0x017a51c3
0x017a51c8
0x017a51cd
0x017a51d0
0x017a51d3
0x017a51d8
0x017a51db
0x017a51de
0x017a51e0
0x017a51e3
0x017a51e6
0x017a51e8
0x017a5342
0x017a5351
0x017a5356
0x017a535a
0x017a5360
0x017a5363
0x017a5366
0x017a5369
0x017a5369
0x017a536b
0x017a536b
0x017a5370
0x017a53a3
0x017a53a4
0x017a53a6
0x017a53ab
0x017a53ab
0x017a53ae
0x017a53ae
0x017a53b5
0x017a53bf
0x017a53bf
0x017a5375
0x017a5396
0x017a53a0
0x017a53a0
0x00000000
0x017a5396
0x017a5377
0x017a5379
0x017a537f
0x017a538c
0x017a5390
0x00000000
0x017a5390
0x017a51ee
0x017a51f1
0x017a5301
0x017a5310
0x017a5315
0x017a5318
0x017a531b
0x017a5320
0x017a532e
0x017a5331
0x00000000
0x017a5331
0x017a5328
0x017a5329
0x00000000
0x017a5329
0x017a51fa
0x017a5235
0x017a5236
0x017a5239
0x017a523f
0x017a5240
0x017a5241
0x017a5242
0x017a5246
0x017a5247
0x017a524e
0x017a5251
0x017a5267
0x017a5269
0x017a526e
0x017a527d
0x017a527e
0x017a5281
0x017a5282
0x017a5287
0x017a5288
0x017a528a
0x017a528f
0x017a5294
0x00000000
0x00000000
0x017a529a
0x017a529c
0x017a529e
0x017a529e
0x017a52a4
0x017a52b0
0x00000000
0x00000000
0x017a52ba
0x017a52bc
0x017a52bc
0x017a52d4
0x017a52d9
0x017a52dc
0x017a52e1
0x00000000
0x00000000
0x017a52e7
0x017a52f4
0x00000000
0x017a52f4
0x017a5270
0x00000000
0x017a5270
0x017a51fc
0x017a51fd
0x017a5202
0x017a5203
0x017a5205
0x017a520a
0x017a520f
0x00000000
0x00000000
0x017a521b
0x017a5226
0x017a522b
0x017a521d
0x017a521d
0x017a5222
0x017a5222
0x017a522d
0x00000000

Strings

Legacy, xrefs: 017A5226
UEFI, xrefs: 017A521D

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 51d1f9c13e3de463a7eb6205efdad89a96a7de244a97868558bea45460654df9
Instruction ID: 8f5315d551008773e12e8e5592873a73a1bb9b3ad4a7da7c25a2579e0a8ed9f4
Opcode Fuzzy Hash: 51d1f9c13e3de463a7eb6205efdad89a96a7de244a97868558bea45460654df9
Instruction Fuzzy Hash: EF517CB1A046099FDB25DFA8C850BAEFBF8FF88704F54426DE609EB291D6719900CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0173D5E0 Relevance: 1.9, APIs: 1, Instructions: 353
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E0173D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x181d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E01736600(0x18152d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1817b9c; // 0x0
							_t281 = L01744620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E0176F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1817b90; // 0x77380000
								if(_t384 == 0) {
									_t353 =  *0x1817b8c; // 0x1122b10
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E01742280(_t200, 0x18184d8);
									_t277 =  *0x18185f4; // 0x1123000
									_t351 =  *0x18185f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x1122f98
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E0173FFB0(_t287, _t353, 0x18184d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E0177CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E01736600(0x18152d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E01737926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x181b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E017AE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1818472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x181b218; // 0x0
														asm("ror edi, cl");
														 *0x181b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E01742280(_t250, 0x18184d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L01763898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E0173FFB0(_t293, _t353, 0x18184d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E017637F5(_t353, 0);
																}
																E01760413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E01759B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E017502D6(_t174);
																}
																L017477F0( *0x1817b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E0175C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L0173EC7F(_t353);
										L017519B8(_t287, 0, _t353, 0);
										_t200 = E0172F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E0176B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x181b2f8; // 0x0
									if((_t206 |  *0x181b2fc) == 0 || ( *0x181b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x181b2ec; // 0x0
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E017D6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E017D6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E0173E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L0173EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E01769730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E0173E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L01738F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E01763C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x0173d5f2
0x0173d5f5
0x0173d5f5
0x0173d5fd
0x0173d600
0x0173d60a
0x0173d60d
0x0173d617
0x0173d61d
0x0173d627
0x0173d62e
0x0173d911
0x0173d913
0x00000000
0x0173d919
0x0173d919
0x0173d919
0x0173d634
0x0173d634
0x0173d634
0x0173d634
0x0173d640
0x0173d8bf
0x00000000
0x0173d646
0x0173d646
0x0173d64d
0x0173d652
0x0178b2fc
0x0178b2fc
0x0178b302
0x0178b33b
0x0178b341
0x00000000
0x0178b304
0x0178b304
0x0178b319
0x0178b31e
0x0178b324
0x0178b326
0x0178b332
0x0178b347
0x0178b34c
0x0178b351
0x0178b35a
0x00000000
0x0178b328
0x0178b328
0x00000000
0x0178b328
0x0178b326
0x0173d658
0x0173d658
0x0173d65b
0x0173d665
0x00000000
0x0173d66b
0x0173d66b
0x0173d66b
0x0173d66b
0x0173d66d
0x0173d672
0x0173d67a
0x00000000
0x00000000
0x0173d680
0x0173d686
0x0173d8ce
0x0173d8d4
0x0173d8dd
0x0173d8e0
0x0173d68c
0x0173d691
0x0173d69d
0x0173d6a2
0x0173d6a7
0x0173d6b0
0x0173d6b5
0x0173d6e0
0x0173d6b7
0x0173d6b7
0x0173d6b9
0x0173d6b9
0x0173d6bb
0x0173d6bd
0x0173d6ce
0x0173d6d0
0x0173d6d2
0x0178b363
0x0178b365
0x00000000
0x0178b36b
0x00000000
0x0178b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0173d6bf
0x0173d6bf
0x0173d6e5
0x0173d6e7
0x0173d6e9
0x0173d6ec
0x0173d6ec
0x0173d6ef
0x0173d6f5
0x0173d6f9
0x0173d6fb
0x0173d6fd
0x0173d701
0x0173d703
0x0173d70a
0x0173d70a
0x0173d701
0x0173d710
0x0173d710
0x0173d6c1
0x0173d6c1
0x0173d6c6
0x0178b36d
0x0178b36f
0x00000000
0x0178b375
0x0178b375
0x0178b375
0x00000000
0x0178b375
0x00000000
0x0173d6cc
0x0173d6d8
0x0173d6d8
0x0173d6d8
0x00000000
0x0173d6c6
0x0173d6bf
0x00000000
0x0173d6da
0x0173d6da
0x0173d716
0x0173d71b
0x0173d720
0x0173d726
0x0173d726
0x0173d72d
0x00000000
0x0173d733
0x0173d739
0x0173d742
0x0173d750
0x0173d758
0x0173d764
0x0173d776
0x0173d77a
0x0173d783
0x0173d928
0x0173d92c
0x0173d93d
0x0173d944
0x0173d94f
0x0173d954
0x0173d956
0x0173d95f
0x0173d961
0x0173d973
0x0173d973
0x0173d956
0x0173d944
0x0173d92c
0x0173d78b
0x0178b394
0x0173d791
0x0173d798
0x0178b3a3
0x0178b3bb
0x0178b3bb
0x0173d7a5
0x0173d866
0x0173d870
0x0173d884
0x0173d892
0x0173d898
0x0173d89e
0x0173d8a0
0x0173d8a6
0x0173d8ac
0x0173d8ae
0x0173d8b4
0x0173d8b4
0x0173d8ae
0x0173d7a5
0x0173d78b
0x0173d7b1
0x0178b3c5
0x0178b3c5
0x0173d7c3
0x0173d7ca
0x0173d7e5
0x0173d7eb
0x0173d8eb
0x0173d8ed
0x00000000
0x0173d8f3
0x0173d8f3
0x0173d8f3
0x00000000
0x0173d8ed
0x0173d7cc
0x0173d7cc
0x0173d7d2
0x00000000
0x0173d7d4
0x0173d7d4
0x0173d7d7
0x0173d7df
0x0178b3d4
0x0178b3d9
0x0178b3dc
0x0178b3dc
0x0178b3df
0x0178b3e2
0x0178b468
0x0178b46d
0x0178b46f
0x0178b46f
0x0178b475
0x0173d8f8
0x0173d8f9
0x0173d8fd
0x0178b3e8
0x0178b3e8
0x0178b3eb
0x0178b3ed
0x00000000
0x0178b3ef
0x0178b3ef
0x0178b3f1
0x0178b3f4
0x0178b3fe
0x0178b404
0x0178b409
0x0178b40e
0x0178b410
0x0178b410
0x0178b414
0x0178b414
0x0178b41b
0x0178b420
0x0178b423
0x0178b425
0x0178b427
0x0178b42a
0x0178b42d
0x0178b42d
0x0178b42a
0x0178b432
0x0178b436
0x0178b438
0x0178b43b
0x0178b43b
0x0178b449
0x0178b44e
0x0178b454
0x0178b458
0x0178b458
0x0178b45d
0x00000000
0x0178b45d
0x0178b3ed
0x00000000
0x00000000
0x00000000
0x0173d7df
0x0173d7d2
0x0173d7ca
0x0178b37c
0x0178b37e
0x0178b385
0x0178b38a
0x00000000
0x0178b38a
0x0173d742
0x0173d7f1
0x0173d7f8
0x0178b49b
0x0178b49b
0x0173d800
0x0173d837
0x0173d843
0x0173d845
0x0173d847
0x0173d84a
0x0173d84b
0x0173d84e
0x0173d857
0x0173d802
0x0173d802
0x0173d80d
0x00000000
0x0173d818
0x0173d818
0x0173d824
0x0173d831
0x0178b4a5
0x0178b4ab
0x0178b4b3
0x0178b4b8
0x0178b4bb
0x00000000
0x0178b4c1
0x0178b4c1
0x0178b4c8
0x00000000
0x0178b4ce
0x0178b4d4
0x0178b4e1
0x0178b4e3
0x0178b4e5
0x00000000
0x0178b4eb
0x0178b4f0
0x0178b4f2
0x0173dac9
0x0173dacc
0x0173dacf
0x0173dad1
0x0173dd78
0x0173dd78
0x0173dcf2
0x00000000
0x0173dad7
0x0173dad9
0x0173dadb
0x00000000
0x00000000
0x0173dae1
0x0173dae1
0x0173dae4
0x0173dae6
0x0178b4f9
0x0178b4f9
0x0178b500
0x0173daec
0x0173daec
0x0173daf5
0x0173daf8
0x0173dafb
0x0173db03
0x0173db11
0x0173db16
0x0173db19
0x0173db1b
0x0178b52c
0x0178b531
0x0178b534
0x0173db21
0x0173db21
0x0173db24
0x0173dcd9
0x0173dce2
0x0173dce5
0x0173dd6a
0x0173dd6d
0x00000000
0x0173dd73
0x0178b51a
0x0178b51c
0x0178b51f
0x0178b524
0x00000000
0x0178b524
0x0173dce7
0x0173dce7
0x0173dce7
0x00000000
0x0173dce7
0x00000000
0x0173db2a
0x0173db2c
0x0173db31
0x0173db33
0x0173db36
0x0173db39
0x0173db3b
0x0173db66
0x0173db66
0x0173db3d
0x0173db3d
0x0173db3e
0x0173db46
0x0173db47
0x0173db49
0x0173db4c
0x0173db53
0x0173db55
0x0173db58
0x0173db5a
0x0178b50a
0x0178b50f
0x0178b512
0x0173db60
0x0173db60
0x0173db63
0x0173db63
0x00000000
0x0173db63
0x0173db5a
0x0173db3b
0x0173db24
0x0173db69
0x0173db69
0x0173db6c
0x0173db6f
0x0173db74
0x0178b557
0x0178b557
0x0178b55e
0x0173db7a
0x0173db7c
0x0173db7f
0x0173db82
0x0173db85
0x00000000
0x0173db8b
0x0173db8b
0x0173db8d
0x0173db9b
0x0173db9b
0x0173db9d
0x0173dba0
0x0173dba2
0x0173dba4
0x0173dba7
0x0173dba9
0x0173dbae
0x0173dbae
0x0173dbb1
0x0173dbb4
0x0173dbb4
0x0173dbb7
0x0173dbba
0x0173dcd2
0x0173dcd4
0x00000000
0x0173dbc0
0x0173dbc0
0x0173dbd2
0x0173dbd7
0x0173dbda
0x0173dbdd
0x0173dbdf
0x00000000
0x0173dbe5
0x0173dbe5
0x0173dbee
0x0173dbf1
0x0178b541
0x0178b544
0x00000000
0x0178b546
0x0178b546
0x00000000
0x0178b546
0x0173dbf7
0x0173dbf7
0x0173dbfd
0x0173dbfd
0x0173dbff
0x0173dc0b
0x0173dc15
0x0173dc1b
0x0173dc1d
0x0173dc21
0x0173dc21
0x0173dc23
0x0173dc23
0x0173dc26
0x0173dc29
0x0173dc2b
0x00000000
0x00000000
0x0173dc31
0x0173dc34
0x0173dc36
0x0173dcbf
0x0173dcbf
0x0173dcc2
0x00000000
0x0173dc3c
0x0173dc41
0x0173dc43
0x00000000
0x0173dc45
0x0173dc45
0x0173dc47
0x00000000
0x0173dc4d
0x0173dc4d
0x0173dc50
0x0173dc52
0x0173dc55
0x0173dcfa
0x0173dcfe
0x0173dd08
0x0173dd0a
0x0173dd0c
0x00000000
0x0173dd12
0x0173dd15
0x0173dd2d
0x0173dd2f
0x0173dd32
0x0173dd35
0x00000000
0x0173dd35
0x0173dc5b
0x0173dc5b
0x0173dc5e
0x0173dc61
0x0173dc64
0x0173dc67
0x0173dc67
0x0173dc6a
0x0173dc6c
0x0173dc8e
0x0173dc8e
0x0173dc91
0x0173dc93
0x0173dcce
0x0173dcce
0x0173dc95
0x0173dc9c
0x0173dc6e
0x0173dc72
0x0173dc75
0x0173dc77
0x0173dc79
0x0178b551
0x0178b551
0x00000000
0x0173dc7f
0x0173dc7f
0x0173dc81
0x00000000
0x0173dc83
0x0173dc86
0x0173dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x0173dc88
0x0173dc81
0x0173dc79
0x0173dc6c
0x0173dc55
0x0173dc47
0x0173dc43
0x00000000
0x0173dc36
0x0173dc23
0x00000000
0x0173dbff
0x0173dbf1
0x0173dbdf
0x0173db8f
0x0173db92
0x0173db95
0x00000000
0x00000000
0x00000000
0x00000000
0x0173db95
0x0173db8d
0x0173db85
0x0173db74
0x0173dc9f
0x0173dca2
0x0173dcb0
0x0173dcb0
0x0173dad1
0x0178b4e5
0x0178b4c8
0x00000000
0x00000000
0x00000000
0x0173d831
0x0173d80d
0x00000000
0x0173d800
0x0178b47f
0x0178b485
0x00000000
0x0178b485
0x0173d665
0x0173d652
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 0173D898

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 2e5313715a0365108b6fba3943e040f878ad82a41702e72dfbe7e8dbf0d4ef11
Instruction ID: b9482ea996e260d90a5cc8f906f48cbd6f5dcf24f391a0fe991e8707e9143d10
Opcode Fuzzy Hash: 2e5313715a0365108b6fba3943e040f878ad82a41702e72dfbe7e8dbf0d4ef11
Instruction Fuzzy Hash: 80E1E031A0035ACFEB32DF68C884BA9F7B6BF85304F4401E9D90997296D770AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0175513A Relevance: 1.8, APIs: 1, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E0175513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x181d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E0176D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E01742280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L01744620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E0176F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0173FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x181b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E0176B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x01755142
0x0175514c
0x01755150
0x01755157
0x01755159
0x0175515e
0x01755165
0x01755169
0x0175516c
0x01755172
0x01755176
0x0175517a
0x0175517a
0x0175517a
0x0175517f
0x01796d8b
0x01796d8e
0x01796d91
0x01796d95
0x01796d98
0x01796d9c
0x01796da0
0x01796da3
0x01796da7
0x01796e26
0x01796e26
0x01796e2a
0x017551f9
0x017551f9
0x017551fe
0x01796e33
0x01796e33
0x01796e39
0x01796e3d
0x01796e46
0x01796e50
0x00000000
0x00000000
0x01796e52
0x01796e53
0x01796e56
0x01796e5d
0x00000000
0x00000000
0x00000000
0x01796e5f
0x01796e67
0x01796e77
0x01796e7f
0x01796e80
0x01796e88
0x01796e90
0x01796e9f
0x01796ea5
0x01796ea9
0x01796eb1
0x01796ebf
0x00000000
0x00000000
0x01796ecf
0x01796ed3
0x00000000
0x00000000
0x01796edb
0x01796ede
0x01796ee1
0x01796ee8
0x01796eeb
0x01796eed
0x01796ef0
0x01796ef4
0x01796ef8
0x01796efc
0x00000000
0x00000000
0x01796f0d
0x01796f11
0x01796f32
0x01796f37
0x01796f3b
0x01796f3e
0x01796f41
0x01796f46
0x00000000
0x00000000
0x01796f4c
0x01796f50
0x01796f50
0x01796f54
0x01796f62
0x01796f65
0x01796f6d
0x01796f7b
0x01796f7b
0x01796f93
0x01796f98
0x01796fa0
0x01796fa6
0x01796fb3
0x01796fb6
0x01796fbf
0x01796fc1
0x01796fd5
0x01796fda
0x01796fda
0x01796fdd
0x01796fe2
0x01796fe7
0x01796feb
0x01796fef
0x01796ff3
0x0175520c
0x0175520c
0x0175520f
0x01755215
0x01755234
0x0175523a
0x0175523a
0x01755244
0x01755245
0x01755246
0x01755251
0x01755251
0x01796f13
0x01796f17
0x01796f17
0x01796f18
0x01796f1b
0x01796f1f
0x01796f23
0x00000000
0x01796f28
0x01755204
0x01755204
0x01755208
0x00000000
0x01755208
0x01755185
0x01755188
0x0175518a
0x0175518e
0x01755195
0x01796db1
0x01796db5
0x01796db9
0x0175519b
0x0175519b
0x0175519e
0x017551a7
0x017551a9
0x017551a9
0x017551b5
0x017551b8
0x017551bb
0x017551be
0x017551c1
0x017551c5
0x017551c9
0x017551cd
0x017551cd
0x017551d8
0x017551dc
0x017551e0
0x01796dcc
0x01796dd0
0x01796dd5
0x01796ddd
0x01796de1
0x01796de1
0x01796de5
0x01796deb
0x01796df1
0x01796df7
0x01796dfd
0x01796e01
0x01796e05
0x01796e09
0x01796e0d
0x01796e11
0x01796e11
0x017551eb
0x01796e1a
0x01796e1f
0x01796e21
0x01796e23
0x00000000
0x017551f1
0x017551f1
0x00000000
0x017551f1

APIs

RtlDebugPrintTimes.NTDLL ref: 01755234

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: dd05ad96a494238ffc821e370c925f66b9670288e697983264a562d01c721c96
Instruction ID: 01e682d899ea4935a3fb40d3121c18e87fb2065e74582e28809a9dfd5759e552
Opcode Fuzzy Hash: dd05ad96a494238ffc821e370c925f66b9670288e697983264a562d01c721c96
Instruction Fuzzy Hash: 48C112B55083818FD755CF28C580A5AFBF1BF88304F188A6EF9998B352D771E985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 017503E2 Relevance: 1.8, APIs: 1, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E017503E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x181d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E01750548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E0176B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E0173B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x1817c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E01747D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E01747D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E017A7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E01769830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E017A69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x1817c04 != 0) {
						_t118 = _v12;
						_t120 = E017AA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x1817bd8;
						if( *0x1817bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E017695D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E017699A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E017A3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E0172B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E0176AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x1818474 - 3;
										if( *0x1818474 != 3) {
											 *0x18179dc =  *0x18179dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E01747D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E01747D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E017A7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x1818708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x1817b00; // 0x0
							asm("ror esi, cl");
							 *0x181b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E017695D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E01737F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x017503f1
0x017503f7
0x017503f9
0x017503fb
0x017503fd
0x01750400
0x0175040a
0x01794c7a
0x01750537
0x01750547
0x01750410
0x01750410
0x01750414
0x01750417
0x0175041a
0x01750421
0x01750424
0x0175042b
0x0175043b
0x0175043e
0x0175043f
0x0175043f
0x01750446
0x01750449
0x0175044c
0x0175044f
0x01750459
0x01794c8d
0x0175045f
0x0175045f
0x0175045f
0x01750467
0x01794c97
0x01794c9d
0x01794ca4
0x01794caa
0x01794caf
0x01794cb1
0x01794cc3
0x01794cb3
0x01794cbc
0x01794cbc
0x01794cc8
0x01794ccb
0x01794cd7
0x01794cda
0x01794cdf
0x01794cdf
0x01794ccb
0x01794ca4
0x0175046d
0x0175046f
0x0175046f
0x01750471
0x01750476
0x0175047a
0x0175047b
0x01750483
0x01750489
0x0175048d
0x00000000
0x00000000
0x01794ce9
0x01794cef
0x01794d22
0x01794d22
0x00000000
0x01794d22
0x01794cf1
0x01794cf7
0x00000000
0x00000000
0x01794cf9
0x01794cff
0x00000000
0x00000000
0x01794d05
0x01794d07
0x00000000
0x00000000
0x01794d0d
0x01794d0f
0x01794d14
0x01794d16
0x00000000
0x00000000
0x01794d1c
0x01794d1c
0x01750499
0x01750535
0x01750535
0x00000000
0x01750535
0x017504a6
0x01794d2c
0x01794d37
0x01794d39
0x01794d3b
0x00000000
0x00000000
0x01794d41
0x01794d48
0x01750527
0x0175052b
0x0175052d
0x01750530
0x01750530
0x00000000
0x0175052b
0x01794d4e
0x017504ac
0x017504ac
0x017504af
0x017504b2
0x017504b7
0x017504b9
0x017504bb
0x017504bd
0x017504bf
0x017504c5
0x017504c9
0x01794d53
0x01794d59
0x01794db9
0x01794dba
0x01794dbf
0x01794dc2
0x01794dc4
0x01794dc7
0x01794dce
0x00000000
0x01794dce
0x01794d5b
0x01794d61
0x00000000
0x00000000
0x01794d63
0x01794d69
0x00000000
0x00000000
0x01794d6b
0x01794d6e
0x01794d74
0x01794d76
0x01794d7c
0x01794d7e
0x01794d84
0x01794d89
0x01794d8c
0x01794d8d
0x01794d92
0x01794d95
0x01794d96
0x01794d98
0x01794d9a
0x01794d9f
0x01794da4
0x01794da6
0x01794da8
0x01794daf
0x01794db1
0x01794db1
0x01794daf
0x01794da6
0x01794d84
0x01794d7c
0x00000000
0x01794d74
0x017504d6
0x01794de1
0x017504dc
0x017504dc
0x017504dc
0x017504e4
0x01794deb
0x01794df1
0x01794df8
0x01794dfe
0x01794e03
0x01794e05
0x01794e17
0x01794e07
0x01794e10
0x01794e10
0x01794e1c
0x01794e1f
0x01794e35
0x01794e35
0x01794e1f
0x01794df8
0x017504f1
0x017504fa
0x01794e3f
0x01794e47
0x01794e5b
0x01794e61
0x01794e67
0x01794e69
0x01794e71
0x01794e73
0x01750500
0x01750500
0x01750500
0x017504fa
0x01750508
0x0175051d
0x0175051d
0x0175051f
0x01750524
0x00000000
0x01750524
0x01750515
0x01750517
0x01794e7a
0x01794e7c
0x00000000
0x00000000
0x01794e85
0x00000000
0x01794e85
0x00000000
0x01750517

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ed41537d89887946bd09853b822247da5ed387e08664f6e94ce4cf4c2af892
Instruction ID: a7ca02d11cc5281ab6277e23a58a977d455edbf93e27b9f190be1ab529bfd063
Opcode Fuzzy Hash: c9ed41537d89887946bd09853b822247da5ed387e08664f6e94ce4cf4c2af892
Instruction Fuzzy Hash: 81918831E00255AFEF328B6CD948BADFFA4AB02724F150265FE11AB2D1D7B49D45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0172B171 Relevance: 1.7, APIs: 1, Instructions: 166
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E0172B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x17ff7a8);
				E0177D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0177D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0176D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0176F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E0177DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0176B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0176B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0176E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0176A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x0172b171
0x0172b171
0x0172b171
0x0172b171
0x0172b171
0x0172b176
0x0172b17b
0x0172b180
0x0172b186
0x0172b18f
0x0172b198
0x0172b1a4
0x0172b1aa
0x01784802
0x01784802
0x01784805
0x0178480c
0x0178480e
0x0172b1d1
0x0172b1d3
0x0172b1de
0x0172b1de
0x01784817
0x0178481e
0x01784820
0x01784822
0x01784822
0x01784824
0x01784824
0x0178482a
0x00000000
0x00000000
0x01784835
0x0178483a
0x0178483d
0x0178483f
0x01784842
0x01784842
0x01784842
0x01784846
0x0178484c
0x0178484e
0x01784851
0x01784851
0x01784853
0x01784854
0x01784854
0x01784858
0x0178485a
0x0178485a
0x0178485d
0x0178485f
0x01784861
0x01784861
0x01784866
0x0178486b
0x0178486e
0x01784871
0x01784876
0x01784876
0x01784878
0x0178487b
0x01784884
0x01784884
0x00000000
0x0178487d
0x0178487d
0x01784882
0x01784889
0x01784889
0x0178488f
0x01784891
0x017848e0
0x017848e2
0x017848e4
0x017848e4
0x017848e7
0x017848e7
0x017848ed
0x017848f4
0x017848f6
0x01784951
0x01784951
0x01784953
0x01784953
0x01784956
0x01784956
0x01784958
0x01784959
0x01784959
0x0178495d
0x0178495d
0x0178495f
0x0178495f
0x01784965
0x01784969
0x017849ba
0x017849ba
0x017849c1
0x017849c5
0x017849cc
0x017849d4
0x017849d7
0x017849da
0x017849e4
0x017849e5
0x017849f3
0x01784a02
0x00000000
0x01784a02
0x01784972
0x01784974
0x00000000
0x00000000
0x01784976
0x01784979
0x01784982
0x01784983
0x01784984
0x0178498b
0x0178498d
0x01784991
0x01784993
0x01784999
0x0178499d
0x017849a2
0x017849a2
0x017849a2
0x01784999
0x017849ac
0x00000000
0x017849b3
0x017848f8
0x017848fe
0x00000000
0x00000000
0x00000000
0x017848fe
0x01784895
0x0178489c
0x017848ad
0x017848b2
0x017848b5
0x017848b7
0x017848ba
0x017848bc
0x017848c6
0x017848c6
0x017848cb
0x017848d1
0x017848d4
0x017848d8
0x017848d8
0x00000000
0x017848d8
0x017848be
0x017848c0
0x00000000
0x00000000
0x017848c2
0x00000000
0x00000000
0x00000000
0x017848c4
0x00000000
0x01784882
0x0178487b
0x01784904
0x01784906
0x00000000
0x00000000
0x01784908
0x0178490e
0x00000000
0x00000000
0x01784910
0x01784917
0x01784917
0x00000000
0x01784917
0x0172b1ba
0x017847f9
0x017847fc
0x00000000
0x00000000
0x00000000
0x017847fc
0x0172b1c0
0x0172b1c0
0x0172b1c3
0x0172b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 017848AD

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: a5388a0823d89b45c5ee1d2dd277e62af156f1b41800fd95e16d0107b933913a
Instruction ID: 1811a8d8abe3e04d42206c23be9e9fa596f855c2d5f24ec1a5da67c395cd7d4f
Opcode Fuzzy Hash: a5388a0823d89b45c5ee1d2dd277e62af156f1b41800fd95e16d0107b933913a
Instruction Fuzzy Hash: 8851E471D5026A8FDF31EF68C844BAEFBB0BF04710F1141ADD85AAB282D7B44941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0174B944 Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0174B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x181d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E01747D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E017F8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E01769E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0176B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0176CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E01747D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E017F8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0176AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x1818628; // 0x0
								_v68 = _t77;
								_t78 =  *0x181862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x1818628; // 0x0
							_t116 =  *0x181862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0174b94c
0x0174b956
0x0174b95c
0x0174b95e
0x0174b964
0x0174b969
0x0174b96d
0x0174b96d
0x0174b970
0x0174b974
0x0174b97a
0x0174badf
0x0174badf
0x0174bae2
0x0174bae4
0x0174bae6
0x0174baf0
0x01792cb8
0x0174baf6
0x0174baf6
0x0174baf6
0x0174bafd
0x0174bb1f
0x0174bb1f
0x0174baff
0x0174bb00
0x0174bb00
0x0174bb03
0x0174bb03
0x0174bacb
0x0174bacf
0x0174bad0
0x0174bad1
0x0174badc
0x0174badc
0x0174b980
0x0174b980
0x0174b988
0x0174b98b
0x0174b98d
0x0174b990
0x0174b993
0x0174b999
0x0174b99b
0x0174b9a1
0x0174b9a5
0x0174b9aa
0x0174b9b0
0x0174b9bb
0x0174b9c0
0x0174b9c3
0x0174b9ca
0x0174b9cc
0x0174b9cf
0x0174b9d3
0x0174b9d7
0x0174ba94
0x0174ba94
0x0174ba98
0x0174baa3
0x01792ccb
0x0174baa9
0x0174baa9
0x0174baa9
0x0174bab1
0x01792cd5
0x01792cdd
0x01792cdd
0x0174babb
0x0174babc
0x0174bac2
0x0174bac3
0x0174bac3
0x0174bac6
0x00000000
0x0174b9dd
0x0174b9dd
0x0174b9e7
0x0174b9e7
0x0174b9ec
0x0174b9ec
0x0174b9f1
0x0174b9f5
0x0174b9fa
0x0174ba00
0x0174ba0c
0x0174ba10
0x0174ba10
0x0174ba12
0x0174ba18
0x00000000
0x00000000
0x0174bb26
0x0174bb26
0x0174ba1e
0x0174ba1e
0x0174ba23
0x0174ba25
0x0174ba2c
0x0174ba30
0x0174ba35
0x0174ba35
0x0174ba41
0x0174ba46
0x0174ba4c
0x0174ba50
0x0174ba54
0x0174ba6a
0x0174ba6e
0x0174ba70
0x0174ba74
0x0174ba78
0x0174ba7a
0x0174ba7c
0x0174ba8e
0x0174ba90
0x0174ba92
0x0174bb14
0x0174bb14
0x0174bb16
0x0174bb16
0x00000000
0x0174ba7c
0x0174bb0a
0x0174bb0d
0x00000000
0x00000000
0x00000000
0x0174bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0174B9A5

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 51696491c7097b5ae30c70bda5c605a3580586087bea52467c128d767f4380fe
Instruction ID: 81c8c00892bdb960f099ba5b1eb1243e4874fbb1178bdf5aa9d2f9424b28f5f4
Opcode Fuzzy Hash: 51696491c7097b5ae30c70bda5c605a3580586087bea52467c128d767f4380fe
Instruction Fuzzy Hash: 46514671A08341CFC720DF68C48492AFBF9FB88600F14896EEA9597359D730ED44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 017D3D40 Relevance: 1.6, APIs: 1, Instructions: 98
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E017D3D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x181d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E01742280(_t34, 0x1818a6c);
				_t64 =  *0x1815768; // 0x77495768
				if(_t64 != 0x1815768) {
					while(1) {
						_t8 = _t64 + 8; // 0x77495770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E0173FFB0(_t53, _t64, 0x1818a6c);
						 *0x181b1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E01742280(_t45, 0x1818a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x1815768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E0173FFB0(_t51, _t64, 0x1818a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E0176B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x017d3d40
0x017d3d48
0x017d3d52
0x017d3d59
0x017d3d5d
0x017d3d61
0x017d3d63
0x017d3d67
0x017d3d69
0x017d3d72
0x017d3d76
0x017d3d7a
0x017d3d7f
0x017d3d8b
0x017d3d91
0x017d3d91
0x017d3d91
0x017d3d94
0x017d3d96
0x017d3d9d
0x017d3da1
0x017d3db0
0x017d3dba
0x017d3dbc
0x017d3dbc
0x017d3dc6
0x017d3dcb
0x017d3dcf
0x017d3dd1
0x017d3dd4
0x00000000
0x00000000
0x017d3dd9
0x017d3e0c
0x017d3e0c
0x017d3e0f
0x017d3ddb
0x017d3ddb
0x017d3de0
0x00000000
0x017d3de2
0x017d3de2
0x017d3de4
0x017d3de8
0x017d3deb
0x017d3df1
0x00000000
0x017d3df3
0x017d3df3
0x017d3df5
0x017d3df8
0x017d3dfa
0x00000000
0x017d3dfa
0x017d3df1
0x017d3de0
0x017d3e11
0x017d3e11
0x00000000
0x017d3dfe
0x017d3e04
0x017d3e06
0x00000000
0x017d3e06
0x00000000
0x017d3e04
0x017d3d91
0x017d3e15
0x017d3e1a
0x017d3e1f
0x017d3e1f
0x017d3e23
0x017d3e29
0x00000000
0x00000000
0x017d3e2e
0x00000000
0x017d3e30
0x017d3e30
0x017d3e35
0x00000000
0x017d3e37
0x017d3e3e
0x017d3e42
0x017d3e48
0x017d3e4e
0x00000000
0x017d3e4e
0x017d3e35
0x00000000
0x017d3e2e
0x017d3e5b
0x017d3e5c
0x017d3e5d
0x017d3e68
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 017D3DB0

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: bcb8ac6392b7a122481608fe96a2fd00b8be488478ee3b2041896bc0f5325c2d
Instruction ID: ce0e0794787cd460df0e13740bf5d7790018b477846ed7059e3b66292ec30189
Opcode Fuzzy Hash: bcb8ac6392b7a122481608fe96a2fd00b8be488478ee3b2041896bc0f5325c2d
Instruction Fuzzy Hash: F43157B2A09306CFC710DF18D58591AFBF5FB8A700F05496EE8889B295D730DA04CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 01764A2C Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01764A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x181d360 ^ _t62;
				_v8 =  *0x181d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E01742280(_t26, 0x1818608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E0173FFB0(_t41, _t51, 0x1818608);
						L2:
						 *0x181b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E0176B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E01742280(_t28, 0x1818608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E0173FFB0(_t42, _t53, 0x1818608);
							if(_t53 != 0) {
								L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E0173FFB0(_t41, _t51, 0x1818608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x01764a2c
0x01764a34
0x01764a3c
0x01764a3e
0x01764a48
0x01764a4b
0x01764a4d
0x01764a51
0x01764a9c
0x00000000
0x00000000
0x01764aa3
0x01764aa8
0x01764aad
0x01764ab1
0x01764ade
0x01764ae3
0x01764a5a
0x01764a62
0x01764a6a
0x01764a6e
0x0179f203
0x01764a84
0x01764a88
0x01764a89
0x01764a8a
0x01764a95
0x01764a95
0x01764a79
0x01764a80
0x01764af2
0x01764af4
0x01764af9
0x01764aff
0x01764b01
0x01764b03
0x01764b08
0x0179f20a
0x0179f212
0x0179f216
0x0179f216
0x01764b08
0x01764b13
0x01764b1a
0x0179f229
0x0179f229
0x01764b1a
0x01764a82
0x00000000
0x01764a82
0x01764ab7
0x01764acd
0x01764acd
0x01764ad5
0x01764ada
0x00000000
0x01764ada
0x01764ac2
0x01764acb
0x00000000
0x00000000
0x00000000
0x01764acb
0x01764a53
0x01764a53
0x01764a58
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 01764A62

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 39b5572ad79d7746df76691928afdc6a5930bcd30ac3aa461a3b9792e8108695
Instruction ID: d498c515524c90ab390127176fd33e6527dafc0fc4175730fb4836e3ba1fe39f
Opcode Fuzzy Hash: 39b5572ad79d7746df76691928afdc6a5930bcd30ac3aa461a3b9792e8108695
Instruction Fuzzy Hash: 6C31F132205611ABCB229F18C989B2EFBACFBC1B10F054569EC5687245CB70DA04CB96

Uniqueness

Uniqueness Score: -1.00%

Function 01740050 Relevance: 1.6, APIs: 1, Instructions: 81
timeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E01740050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x181d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E01759ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E0176B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E017F8A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E01759702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x181b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x01740055
0x0174005d
0x01740062
0x0174006c
0x0174006f
0x01740074
0x0174007a
0x0174007a
0x01740080
0x01740080
0x01740087
0x0174008d
0x0174008f
0x01740093
0x01740095
0x0174009b
0x017400f8
0x017400fb
0x017400fc
0x017400ff
0x01740108
0x01740108
0x017400a2
0x017400a6
0x017400b3
0x017400bc
0x017400c5
0x017400ca
0x0178c01e
0x00000000
0x00000000
0x0178c02d
0x017400d5
0x017400d9
0x0178c03d
0x0178c046
0x0178c046
0x017400df
0x017400e2
0x017400ea
0x017400ef
0x017400f2
0x017400f6
0x01740111
0x01740117
0x01740117
0x00000000
0x017400f6
0x017400d0
0x017400d0
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 01740111

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 66c7c54b4274d61f9f1047deb2565639f0b521973f691d0e220751e85c42f58b
Instruction ID: d1b786680196d9776d841552ca93e0959514855789176ff83fe10b008eac12b6
Opcode Fuzzy Hash: 66c7c54b4274d61f9f1047deb2565639f0b521973f691d0e220751e85c42f58b
Instruction Fuzzy Hash: A0318D31201B04CFD722CF28C844B9AF7E5FF89714F14456DEAA687BA0EB75A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01752581 Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E01752581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, void* _a12, void* _a16, void* _a20, void* _a24) {
				char _v3;
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				void* _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t240;
				signed int _t244;
				signed int _t245;
				signed int _t246;
				signed int _t275;
				intOrPtr _t281;
				signed int _t283;
				signed int _t285;
				unsigned int _t291;
				signed int _t295;
				signed int _t322;
				signed int _t324;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				void* _t333;
				signed int _t336;
				signed int _t339;
				signed int _t340;

				_t336 = _t339;
				_t340 = _t339 - 0x4c;
				_v8 =  *0x181d360 ^ _t336;
				_t329 = 0x181b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t291 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t281 = 0x48;
				_t311 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t322 = 0;
				_v37 = _t311;
				if(_v48 <= 0) {
					L16:
					_t45 = _t281 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t330 = 0xc0000106;
						goto L32;
					} else {
						_t329 = L01744620(_t291,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t281);
						_v52 = _t329;
						__eflags = _t329;
						if(_t329 == 0) {
							_t330 = 0xc0000017;
							goto L32;
						} else {
							 *(_t329 + 0x44) =  *(_t329 + 0x44) & 0x00000000;
							_t50 = _t329 + 0x48; // 0x48
							_t324 = _t50;
							_t311 = _v32;
							 *((intOrPtr*)(_t329 + 0x3c)) = _t281;
							_t283 = 0;
							 *((short*)(_t329 + 0x30)) = _v48;
							__eflags = _t311;
							if(_t311 != 0) {
								 *(_t329 + 0x18) = _t324;
								__eflags = _t311 - 0x1818478;
								 *_t329 = ((0 | _t311 == 0x01818478) - 0x00000001 & 0xfffffffb) + 7;
								E0176F3E0(_t324,  *((intOrPtr*)(_t311 + 4)),  *_t311 & 0x0000ffff);
								_t311 = _v32;
								_t340 = _t340 + 0xc;
								_t283 = 1;
								__eflags = _a8;
								_t324 = _t324 + (( *_t311 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t275 = E017B39F2(_t324);
									_t311 = _v32;
									_t324 = _t275;
								}
							}
							_t295 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t330 = _v68;
								__eflags = 0;
								 *((short*)(_t324 - 2)) = 0;
								goto L32;
							} else {
								_t285 = _t329 + _t283 * 4;
								_v56 = _t285;
								do {
									__eflags = _t311;
									if(_t311 != 0) {
										_t240 =  *(_v60 + _t295 * 4);
										__eflags = _t240;
										if(_t240 == 0) {
											goto L30;
										} else {
											__eflags = _t240 == 5;
											if(_t240 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t285 =  *(_v60 + _t295 * 4);
										 *(_t285 + 0x18) = _t324;
										_t244 =  *(_v60 + _t295 * 4);
										__eflags = _t244 - 8;
										if(__eflags > 0) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t244 * 4 +  &M01752959))) {
												case 0:
													__ax =  *0x1818488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E0176F3E0(__edi,  *0x181848c, __ax & 0x0000ffff);
														__eax =  *0x1818488 & 0x0000ffff;
														goto L26;
													}
													goto L126;
												case 1:
													L45:
													E0176F3E0(_t324, _v80, _v64);
													_t270 = _v64;
													goto L26;
												case 2:
													 *0x1818480 & 0x0000ffff = E0176F3E0(__edi,  *0x1818484,  *0x1818480 & 0x0000ffff);
													__eax =  *0x1818480 & 0x0000ffff;
													__eax = ( *0x1818480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E0176F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L126;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E0176F3E0(_t324, _v76, _v36);
														_t270 = _v36;
													}
													L26:
													_t340 = _t340 + 0xc;
													_t324 = _t324 + (_t270 >> 1) * 2 + 2;
													__eflags = _t324;
													L27:
													_push(0x3b);
													_pop(_t272);
													 *((short*)(_t324 - 2)) = _t272;
													goto L28;
												case 6:
													__ebx = "\\WIw\\WIw";
													__eflags = __ebx - "\\WIw\\WIw";
													if(__ebx != "\\WIw\\WIw") {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E0176F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - "\\WIw\\WIw";
														} while (__ebx != "\\WIw\\WIw");
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1818478 & 0x0000ffff = E0176F3E0(__edi,  *0x181847c,  *0x1818478 & 0x0000ffff);
													__eax =  *0x1818478 & 0x0000ffff;
													__eax = ( *0x1818478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E017B39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1816e58 & 0x0000ffff = E0176F3E0(__edi,  *0x1816e5c,  *0x1816e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1816e58 & 0x0000ffff;
													__eax = ( *0x1816e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t295 = _v16;
													_t311 = _v32;
													L29:
													_t285 = _t285 + 4;
													__eflags = _t285;
													_v56 = _t285;
													goto L30;
											}
										}
									}
									goto L126;
									L30:
									_t295 = _t295 + 1;
									_v16 = _t295;
									__eflags = _t295 - _v48;
								} while (_t295 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t244 =  *(_v60 + _t322 * 4);
						if(_t244 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t244 * 4 +  &M01752935))) {
							case 0:
								__ax =  *0x1818488;
								__eflags = __ax;
								if(__eflags != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t311 =  &_v64;
								_v80 = E01752E3E(0,  &_v64);
								_t281 = _t281 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1818480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x1818480;
									goto L98;
								}
								goto L14;
							case 3:
								__eax = E0173EEF0(0x18179a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L75();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E0173EB70(__ecx, 0x18179a0);
									__eflags = __esi - 0xc0000100;
									if(__eflags == 0) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t218 = _v72;
											__eflags = _t218;
											if(_t218 != 0) {
												L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t218);
											}
											_t219 = _v52;
											__eflags = _t219;
											if(_t219 != 0) {
												__eflags = _t330;
												if(_t330 < 0) {
													L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t219);
													_t219 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t291 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1817b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E0173EB70(__ecx, 0x18179a0);
										__eax = _v52;
										L36:
										_pop(_t323);
										_pop(_t331);
										__eflags = _v8 ^ _t336;
										_pop(_t282);
										return E0176B640(_t219, _t282, _v8 ^ _t336, _t311, _t323, _t331);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L75();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L126;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t277 = _v56;
								if(_v56 != 0) {
									_t311 =  &_v36;
									_t279 = E01752E3E(_t277,  &_v36);
									_t291 = _v36;
									_v76 = _t279;
								}
								if(_t291 == 0) {
									goto L44;
								} else {
									_t281 = _t281 + 2 + _t291;
								}
								goto L14;
							case 6:
								__eax =  *0x1815764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1818478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x1818478;
									L98:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1816e58 & 0x0000ffff;
								__eax = ( *0x1816e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t322 = _t322 + 1;
								if(_t322 >= _v48) {
									goto L16;
								} else {
									_t311 = _v37;
									goto L1;
								}
								goto L126;
						}
					}
					L56:
					_push(0x25);
					asm("int 0x29");
					asm("out 0x28, al");
					if(__eflags == 0) {
						asm("o16 sub [ebp+0x1], dh");
					}
					_t105 =  &_v3;
					 *_t105 = _v3 - _t311;
					__eflags =  *_t105;
					asm("loopne 0x29");
					if(__eflags == 0) {
						if (__eflags != 0) goto L62;
					}
					if(__eflags == 0) {
						_t329 = _t329 + 1;
						__eflags = _t329;
					}
					_v3 = _v3 - _t311;
					_t245 = _t244 + 0x1f017526;
					__eflags = _t245;
					if(_t245 < 0) {
						_t245 = _t340;
					}
					_v3 = _v3 - _t311;
					_t246 = _t245 ^ 0x0201795b;
					_v3 = _v3 - _t329;
					 *_t246 =  *_t246 - 0x75;
					_t332 = _t329 + _t329;
					__eflags = _t332;
					asm("daa");
					if(_t332 == 0) {
						_push(ds);
					}
					_v3 = _v3 - _t311;
					_t333 = _t332 - 1;
					_t116 =  &_v3;
					 *_t116 = _v3 - _t311;
					__eflags =  *_t116;
					asm("daa");
					if(__eflags == 0) {
						asm("fcomp dword [ebx+0x79]");
					}
					if(__eflags < 0) {
						_t246 = 0x28;
					}
					_t118 =  &_v3;
					 *_t118 = _v3 - _t311;
					__eflags =  *_t118;
				}
				L126:
			}

0x01752584
0x01752586
0x01752590
0x01752599
0x0175259e
0x017525a4
0x017525a9
0x017525ac
0x017525ae
0x017525b1
0x017525b2
0x017525b5
0x017525b8
0x017525bb
0x017525bc
0x017525bf
0x017525c2
0x017525c5
0x017525c6
0x017525cb
0x017525ce
0x017525d8
0x017525dd
0x017525de
0x017525e1
0x017525e3
0x017525e9
0x017526da
0x017526da
0x017526dd
0x017526e2
0x01795b56
0x00000000
0x017526e8
0x017526f9
0x017526fb
0x017526fe
0x01752700
0x01795b60
0x00000000
0x01752706
0x01752706
0x0175270a
0x0175270a
0x0175270d
0x01752713
0x01752716
0x01752718
0x0175271c
0x0175271e
0x01795b6c
0x01795b6f
0x01795b7f
0x01795b89
0x01795b8e
0x01795b93
0x01795b96
0x01795b9c
0x01795ba0
0x01795ba3
0x01795bab
0x01795bb0
0x01795bb3
0x01795bb3
0x01795ba3
0x01752724
0x01752726
0x01752729
0x0175272c
0x0175279d
0x0175279d
0x017527a0
0x017527a2
0x00000000
0x0175272e
0x0175272e
0x01752731
0x01752734
0x01752734
0x01752736
0x01795bc1
0x01795bc1
0x01795bc4
0x00000000
0x01795bca
0x01795bca
0x01795bcd
0x00000000
0x01795bd3
0x00000000
0x01795bd3
0x01795bcd
0x0175273c
0x0175273c
0x01752742
0x01752747
0x0175274a
0x0175274d
0x01752750
0x00000000
0x01752756
0x01752756
0x00000000
0x01752902
0x01752908
0x0175290b
0x00000000
0x01752911
0x0175291c
0x01752921
0x00000000
0x01752921
0x00000000
0x00000000
0x01752880
0x01752887
0x0175288c
0x00000000
0x00000000
0x01752805
0x0175280a
0x01752814
0x01752816
0x00000000
0x00000000
0x0175281e
0x01752821
0x01752823
0x00000000
0x01752829
0x01752829
0x01752831
0x0175283c
0x0175283e
0x00000000
0x0175283e
0x00000000
0x00000000
0x0175284e
0x01752850
0x01752851
0x01752854
0x01752857
0x0175285a
0x0175285c
0x0175285d
0x00000000
0x00000000
0x0175275d
0x01752761
0x00000000
0x01752767
0x0175276e
0x01752773
0x01752773
0x01752776
0x01752778
0x0175277e
0x0175277e
0x01752781
0x01752781
0x01752783
0x01752784
0x00000000
0x00000000
0x01795bd8
0x01795bde
0x01795be4
0x01795be6
0x01795be8
0x01795be9
0x01795bee
0x01795bf8
0x01795bff
0x01795c01
0x01795c04
0x01795c07
0x01795c0b
0x01795c0d
0x01795c0d
0x01795c15
0x01795c18
0x01795c1b
0x01795c1b
0x01795c1e
0x00000000
0x00000000
0x017528c3
0x017528c8
0x017528d2
0x017528d4
0x017528d8
0x017528db
0x01795c26
0x01795c28
0x01795c2d
0x01795c2d
0x00000000
0x00000000
0x01795c34
0x01795c36
0x01795c49
0x01795c4e
0x01795c54
0x01795c5b
0x01795c5d
0x01795c60
0x01752788
0x01752788
0x0175278b
0x0175278e
0x0175278e
0x0175278e
0x01752791
0x00000000
0x00000000
0x01752756
0x01752750
0x00000000
0x01752794
0x01752794
0x01752795
0x01752798
0x01752798
0x00000000
0x01752734
0x0175272c
0x01752700
0x017525ef
0x017525ef
0x017525ef
0x017525f2
0x017525f8
0x00000000
0x00000000
0x017525fe
0x00000000
0x017528e6
0x017528ec
0x017528ef
0x017528f5
0x017528f8
0x017528f8
0x00000000
0x017528f8
0x00000000
0x00000000
0x01752866
0x01752866
0x01752876
0x01752879
0x00000000
0x00000000
0x017527e0
0x017527e7
0x017527e9
0x017527eb
0x01795afd
0x00000000
0x01795afd
0x00000000
0x00000000
0x01752633
0x01752638
0x0175263b
0x0175263c
0x0175263e
0x01752640
0x01752642
0x01752647
0x01752649
0x0175264e
0x01752650
0x01752653
0x01752659
0x017526a2
0x017526a7
0x017526ac
0x017526b2
0x01795b11
0x01795b15
0x01795b17
0x00000000
0x017526b8
0x017526b8
0x017526ba
0x017527a6
0x017527a6
0x017527a9
0x017527ab
0x017527b9
0x017527b9
0x017527be
0x017527c1
0x017527c3
0x017527c5
0x017527c7
0x01795c74
0x01795c79
0x01795c79
0x017527c7
0x00000000
0x017526c0
0x017526c0
0x017526c3
0x017526c6
0x017526c6
0x017526c9
0x017526c9
0x00000000
0x017526c9
0x017526ba
0x0175265b
0x0175265b
0x0175265e
0x01752667
0x0175266d
0x01752677
0x0175267c
0x0175267f
0x01752681
0x01795b49
0x01795b4e
0x017527cd
0x017527d0
0x017527d1
0x017527d2
0x017527d4
0x017527dd
0x01752687
0x01752687
0x0175268a
0x0175268b
0x0175268e
0x0175268f
0x01752691
0x01752696
0x01752698
0x0175269d
0x0175269f
0x00000000
0x0175269f
0x01752681
0x00000000
0x00000000
0x01752846
0x00000000
0x00000000
0x01752605
0x0175260a
0x0175260c
0x01752611
0x01752616
0x01752619
0x01752619
0x0175261e
0x00000000
0x01752624
0x01752627
0x01752627
0x00000000
0x00000000
0x01795b1f
0x00000000
0x00000000
0x01752894
0x0175289b
0x0175289d
0x017528a1
0x01795b2b
0x01795b2e
0x01795b2e
0x017528a7
0x017528a9
0x01795b04
0x01795b09
0x01795b09
0x01795b09
0x00000000
0x00000000
0x01795b35
0x01795b3c
0x017528fb
0x017528fb
0x017526cc
0x017526cc
0x017526d0
0x00000000
0x017526d2
0x017526d2
0x00000000
0x017526d2
0x00000000
0x00000000
0x017525fe
0x0175292d
0x0175292d
0x01752930
0x01752935
0x01752937
0x01752939
0x01752939
0x0175293a
0x0175293a
0x0175293a
0x0175293d
0x0175293f
0x01752941
0x01752941
0x01752942
0x01752945
0x01752945
0x01752945
0x01752946
0x01752949
0x01752949
0x0175294f
0x01752951
0x01752951
0x01752952
0x01752955
0x0175295a
0x0175295d
0x01752960
0x01752960
0x01752962
0x01752963
0x01752965
0x01752965
0x01752966
0x01752969
0x0175296a
0x0175296a
0x0175296a
0x0175296e
0x0175296f
0x01752971
0x01752971
0x01752973
0x01752975
0x01752975
0x01752976
0x01752976
0x01752976
0x01752976
0x00000000

Strings

PATH, xrefs: 01752642, 01752691

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: e203f08ca858dabf44e9aa32a6312b61c400f9f40081c37ec86b751294b09153
Instruction ID: d3cc3321a537fae95dcbf39aeeb1f7feeee11339de06367c9e0f18cf4eb0bf25
Opcode Fuzzy Hash: e203f08ca858dabf44e9aa32a6312b61c400f9f40081c37ec86b751294b09153
Instruction Fuzzy Hash: 8CC1D072E00219DBDB65DFA8D881BADFBB5FF48700F044429EA01BB255DBB4A901CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0172C962 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0172C962(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				intOrPtr _t22;
				void* _t26;
				void* _t27;
				void* _t32;
				intOrPtr _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x181d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E0173EEF0(0x18170a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E017AF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E0173EB70(_t29, 0x18170a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E0176B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E017AF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x18170c0; // 0x0
					while(_t38 != 0x18170c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x181b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x0172c96a
0x0172c974
0x0172c988
0x0172c98a
0x01797c9d
0x01797c9f
0x01797ca4
0x01797cae
0x01797cf0
0x01797cf5
0x01797cfa
0x0172c992
0x0172c996
0x0172c997
0x0172c998
0x0172c9a3
0x0172c9a3
0x01797cb0
0x01797cb7
0x01797cbb
0x00000000
0x00000000
0x01797cbd
0x01797ce8
0x01797cc5
0x01797cc8
0x01797cca
0x01797cd0
0x01797cd6
0x01797cde
0x01797ce4
0x01797ce4
0x01797cd0
0x00000000
0x01797ce8
0x0172c990
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edbef1d0bd4cd75667f0bcace253af28d3de3c721fd301231c86b90909e6463
Instruction ID: c86d5bed9deca19a1e89c9243b969e4a693398b2e2ce1fe2bebdd5499a46521a
Opcode Fuzzy Hash: 4edbef1d0bd4cd75667f0bcace253af28d3de3c721fd301231c86b90909e6463
Instruction Fuzzy Hash: 2811C2323107469BCB15AF2CEC89A2AF7A9BF95710B00052DE94193655DB20EE18CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0175FAB0 Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0175FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0173EEF0(0x1817b60);
					_t134 =  *0x1817b84; // 0x77497b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x1817b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x1817b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E01736D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E017376E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E017C8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0172B150();
													}
													_t116 = E017C6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E017375CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x1818638; // 0x0
																	_t122 = L017338A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E017376E2(_t154);
																			goto L41;
																		}
																	} else {
																		E017376E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0175FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L017370F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0175FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0175FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0175FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0175FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0175FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x1817b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x1817b84 = _t75;
						_t73 = E0173EB70(_t134, 0x1817b60);
						if( *0x1817b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0173FF60( *0x1817b20);
							}
						}
						goto L5;
					}
				}
			}

0x0175fab0
0x0175fab2
0x0175fab3
0x0175fab4
0x0175fabc
0x0175fac0
0x0175fb14
0x0175fb17
0x0175fac2
0x0175fac8
0x0175facd
0x0175fad3
0x0175fad3
0x0175fadd
0x0175fb18
0x0175fb1b
0x0175fb1d
0x0175fb1e
0x0175fb1f
0x0175fb20
0x0175fb21
0x0175fb22
0x0175fb23
0x0175fb24
0x0175fb25
0x0175fb26
0x0175fb27
0x0175fb28
0x0175fb29
0x0175fb2a
0x0175fb2b
0x0175fb2c
0x0175fb2d
0x0175fb2e
0x0175fb2f
0x0175fb3a
0x0175fb3b
0x0175fb3e
0x0175fb41
0x0175fb44
0x0175fb47
0x0175fb4a
0x0175fb4d
0x0175fb53
0x0179bdcb
0x0179bdcb
0x0175fb59
0x0175fb5b
0x0175fb5b
0x0175fb5e
0x0179bdd5
0x0179bdd8
0x00000000
0x0179bdda
0x00000000
0x0179bdda
0x0175fb64
0x0175fb64
0x0175fb64
0x0175fb67
0x0175fb6e
0x0175fb70
0x0175fb72
0x00000000
0x0175fb78
0x0175fb7a
0x0175fb7a
0x0175fb7d
0x0175fb80
0x0179bddf
0x0179bde1
0x00000000
0x0179bde3
0x00000000
0x0179bde3
0x0175fb86
0x0175fb86
0x0175fb86
0x0175fb8b
0x0175fb90
0x0175fb92
0x0175fb94
0x0175fb9a
0x0175fb9b
0x0175fba1
0x0179bde8
0x0179bdeb
0x0179bded
0x0179beb5
0x0179beb5
0x0179bebb
0x0179bebd
0x0179bec3
0x0179bed2
0x0179bedd
0x0179bedd
0x0179beed
0x00000000
0x0179bdf3
0x0179bdfe
0x0179be06
0x0179be0b
0x0179be0d
0x0179be0f
0x0179be14
0x0179be19
0x0179be20
0x0179be25
0x0179be27
0x0179be35
0x0179be39
0x0179be46
0x0179be4f
0x0179be54
0x0179be56
0x0179bef8
0x0179bef8
0x00000000
0x0179be5c
0x0179be5c
0x0179be60
0x00000000
0x0179be66
0x0179be66
0x0179be7f
0x0179be84
0x0179be87
0x0179be89
0x0179be8b
0x0179be99
0x0179be9d
0x0179bea0
0x0179beac
0x0179beaf
0x0179beb1
0x0179beb3
0x0179beb3
0x00000000
0x0179bea2
0x0179bea2
0x00000000
0x0179bea2
0x0179be8d
0x0179be8d
0x0179be92
0x00000000
0x0179be92
0x0179be8b
0x0179be60
0x0179be3b
0x0179be3b
0x0179be3e
0x00000000
0x0179be40
0x0179be40
0x0179be44
0x00000000
0x00000000
0x00000000
0x00000000
0x0179be44
0x0179be3e
0x0179be29
0x0179be29
0x00000000
0x0179be29
0x0179be27
0x00000000
0x0175fba7
0x0175fba7
0x0175fbab
0x0179bf02
0x0175fbb1
0x0175fbb1
0x0175fbb8
0x0175fbbd
0x0175fbbd
0x0175fbbf
0x0175fbbf
0x0175fbc5
0x0175fbcb
0x0175fbf8
0x0175fbf8
0x0175fbfa
0x00000000
0x0175fc00
0x0175fc00
0x0175fc03
0x00000000
0x0175fc09
0x0175fc09
0x0175fc0f
0x0175fc15
0x0175fc23
0x0175fc23
0x0175fc25
0x0175fc27
0x0175fc75
0x0175fc7c
0x0175fc84
0x00000000
0x0175fc29
0x0175fc29
0x0175fc2d
0x0175fc30
0x0179bf0f
0x00000000
0x0175fc36
0x0175fc38
0x0175fc3b
0x0175fc41
0x0179bf17
0x0179bf19
0x0179bf48
0x0179bf4b
0x00000000
0x0179bf1b
0x0179bf22
0x0179bf24
0x0179bf26
0x00000000
0x0179bf2c
0x0179bf37
0x0179bf39
0x0179bf3b
0x00000000
0x0179bf41
0x0179bf41
0x0179bf41
0x0179bf41
0x0179bf45
0x00000000
0x0179bf45
0x0179bf3b
0x0179bf26
0x00000000
0x0175fc47
0x0175fc47
0x0175fc49
0x0175fcb2
0x0175fcb4
0x0175fcb6
0x0175fcdc
0x0175fcdc
0x00000000
0x0175fcb8
0x0175fcc3
0x0175fcc5
0x0175fcc7
0x00000000
0x0175fcc9
0x0175fcc9
0x0175fccd
0x00000000
0x0175fccd
0x0175fcc7
0x00000000
0x0175fc4b
0x0175fc4b
0x0175fc4e
0x0175fc4e
0x0175fc51
0x0175fc51
0x0175fc54
0x0175fc5a
0x0175fc5c
0x0175fc5f
0x0175fc61
0x0175fc63
0x0175fc65
0x0175fc67
0x0175fc6e
0x0175fc72
0x0175fc72
0x0175fc72
0x0175fc72
0x0175fc67
0x0175fc61
0x00000000
0x0175fc5a
0x0175fc49
0x0175fc41
0x0175fc30
0x0175fc27
0x0175fc03
0x0175fbcd
0x0175fbd3
0x0175fbd9
0x0175fbdc
0x0175fbde
0x0175fc99
0x0175fc9b
0x0175fc9d
0x0175fcd5
0x0175fcd5
0x0175fc89
0x0175fc89
0x00000000
0x0175fc9f
0x0175fc9f
0x0175fca3
0x00000000
0x0175fca3
0x00000000
0x0175fbe4
0x0175fbe4
0x0175fbe4
0x0175fbe4
0x0175fbe9
0x0175fbf2
0x00000000
0x0175fbf2
0x0175fbde
0x0175fbcb
0x0175fbab
0x0175fc8b
0x0175fc8b
0x0175fc8c
0x0175fb80
0x0175fb72
0x0175fb5e
0x0175fc8d
0x0175fc91
0x0175fadf
0x0175fadf
0x0175fae1
0x0175fae4
0x0175fae7
0x0175faec
0x0175faf8
0x0175fb00
0x0175fb07
0x0175fb0f
0x0175fb0f
0x0175fb07
0x00000000
0x0175faf8
0x0175fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 0179BE0F

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: d022d26c7f2b5f05123d5ab79915d51a73538b2489f742e3d93191b33f22b87e
Instruction ID: bafb06eca7424d25b1e5ab459e3d825c88cb07c524a2e76ed75b1cc8c0c4f4a7
Opcode Fuzzy Hash: d022d26c7f2b5f05123d5ab79915d51a73538b2489f742e3d93191b33f22b87e
Instruction Fuzzy Hash: A7A12171B00606CBEB66DB68D454B7AF7A9AF48710F04457EEE06CB681DBB0D845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01722D8A Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E01722D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x1815350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x1817bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E017697C0();
				}
				if( *0x18179c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x18179c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E01751624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E01747D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E017BFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E01769520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0175E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								E0177DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x1816901;
								_push(_t109);
								_v52 = _t98;
								if( *0x1816901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E01769980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E017695D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E01747D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E01747D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E017A7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E017BFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x1815350;
							if(_t109 != 0x1815350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E017BFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E017B5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x01722d8a
0x01722d8a
0x01722d92
0x01722d96
0x01722d9e
0x01722da0
0x01722da3
0x01722da5
0x01722da8
0x01722dab
0x01722db2
0x0177f9aa
0x0177f9ab
0x0177f9ae
0x0177f9ae
0x01722db8
0x01722dc2
0x0177f9b9
0x0177f9be
0x0177f9bf
0x0177f9bf
0x01722dcf
0x0177f9c9
0x01722dd5
0x01722dd5
0x01722dd5
0x01722dde
0x01722de1
0x01722e70
0x01722e72
0x01722e72
0x01722de7
0x01722deb
0x01722e7c
0x01722e83
0x01722e85
0x01722e8b
0x01722e8d
0x01722e92
0x01722e92
0x01722e85
0x01722df1
0x01722df7
0x01722df9
0x01722df9
0x01722dfc
0x01722dff
0x01722e02
0x00000000
0x01722e05
0x01722e0c
0x0177f9d9
0x01722e12
0x01722e12
0x01722e12
0x01722e1a
0x0177f9e3
0x0177f9e9
0x0177f9f0
0x0177f9f6
0x0177f9f8
0x0177f9f8
0x0177f9f0
0x01722e23
0x0177fa02
0x0177fa03
0x0177fa05
0x0177fa06
0x00000000
0x01722e29
0x01722e29
0x01722e2e
0x01722e34
0x01722e3e
0x00000000
0x00000000
0x01722e44
0x01722e47
0x01722e4d
0x00000000
0x00000000
0x01722e4f
0x01722e54
0x00000000
0x00000000
0x01722e5a
0x01722e5f
0x01722e9a
0x01722ea4
0x01722ea5
0x01722ea8
0x01722eaf
0x01722eb2
0x01722eb5
0x0177fae9
0x0177faeb
0x0177faed
0x0177faef
0x0177faf7
0x0177faf8
0x0177fafd
0x0177faff
0x0177fb04
0x0177fb04
0x0177faff
0x01722ec0
0x01722ec4
0x01722ec6
0x01722ec8
0x0177fb14
0x0177fb18
0x0177fb1e
0x0177fb21
0x0177fb21
0x01722ece
0x01722ece
0x01722ece
0x01722ed7
0x01722e61
0x01722e63
0x0177fa6b
0x0177fa71
0x0177fa76
0x0177fa78
0x0177fa8a
0x0177fa7a
0x0177fa83
0x0177fa83
0x0177fa8f
0x0177fa91
0x0177fa97
0x0177fa9d
0x0177faa4
0x0177faaa
0x0177faaf
0x0177fab1
0x0177fac3
0x0177fab3
0x0177fabc
0x0177fabc
0x0177fac8
0x0177facb
0x0177fadf
0x0177fadf
0x0177facb
0x0177faa4
0x0177fa91
0x01722e6f
0x01722e6f
0x01722e5f
0x0177fa13
0x0177fa15
0x0177fa17
0x0177fa1f
0x0177fa21
0x0177fa22
0x0177fa25
0x0177fa28
0x0177fa2f
0x0177fa2f
0x0177fa2a
0x0177fa2a
0x0177fa2a
0x0177fa31
0x0177fa34
0x0177fa36
0x0177fa3c
0x0177fa3e
0x0177fa41
0x0177fa43
0x0177fa45
0x0177fa45
0x0177fa41
0x0177fa3c
0x0177fa4a
0x0177fa4f
0x0177fa51
0x0177fa53
0x0177fa56
0x0177fa5b
0x0177fa5e
0x00000000
0x0177fa5e
0x01722e23

Strings

RTL: Re-Waiting, xrefs: 0177FA4A

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 07008d14d95375ad10a70cef6d82c31bb23286d20948ad595902f0896ea0d9ca
Instruction ID: e131a73912b935cd2aff0d3c2d6a2799b72cdc90f3fdbc31d9d0123dc74b1fde
Opcode Fuzzy Hash: 07008d14d95375ad10a70cef6d82c31bb23286d20948ad595902f0896ea0d9ca
Instruction Fuzzy Hash: CD613531E006159FEB32EF6CC988B7EFBA5EB45710F1506A9D921972C2C734DA42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 017F0EA5 Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E017F0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E017EFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E017F1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E01769730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E017EA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E017EA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x1818b04 >> 0x14) + (_v44 -  *0x1818b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E01747D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E017E138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E01747D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E017DFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x1818724 & 0x00000008) != 0) {
						E017E52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E017F15B5(0x1818ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x017f0eb7
0x017f0eb9
0x017f0ec0
0x017f0ec2
0x017f0ecd
0x017f105b
0x017f105b
0x017f1061
0x017f1066
0x017f1066
0x017f106b
0x017f1073
0x017f1073
0x017f0ed3
0x017f0ed6
0x017f0edc
0x017f0ee0
0x017f0ee7
0x017f0ef0
0x017f0ef5
0x017f0efa
0x017f0efc
0x017f0efd
0x017f0f03
0x017f0f04
0x017f0f06
0x017f0f07
0x017f0f09
0x017f0f0e
0x017f0f14
0x017f0f23
0x017f0f2d
0x017f0f34
0x017f0f34
0x017f0f14
0x017f0f52
0x00000000
0x00000000
0x017f0f58
0x017f0f73
0x017f0f74
0x017f0f79
0x017f0f7d
0x017f0f80
0x017f0f86
0x017f0fab
0x017f0fb5
0x017f0fc6
0x017f0fd1
0x017f0fe3
0x017f0fd3
0x017f0fdc
0x017f0fdc
0x017f0feb
0x017f1009
0x017f1009
0x017f1015
0x017f1027
0x017f1017
0x017f1020
0x017f1020
0x017f102f
0x017f103c
0x017f103c
0x017f1048
0x017f1050
0x017f1050
0x017f1055
0x00000000
0x017f1055
0x017f0f88
0x017f0f9e
0x017f0fa2
0x017f0fa9
0x00000000
0x00000000
0x00000000
0x017f0fa9
0x00000000

Strings

`, xrefs: 017F0F16

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 0b520d3b59f0dc07f60bcb83a32d69e0eb0d4a87e0ccf9bfc685089f68f06250
Instruction ID: 0aa943d908a7703f1c017bd7ad328b8934fb0f8dfaea62baba9dd73071469a98
Opcode Fuzzy Hash: 0b520d3b59f0dc07f60bcb83a32d69e0eb0d4a87e0ccf9bfc685089f68f06250
Instruction Fuzzy Hash: 62519C713043429FE325DF28D984B1BBBEAEB84704F44092CFA8697391D670E805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0175F0BF Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0175F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E01744120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E01769830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E01769990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E017695D0();
							goto L11;
						} else {
							_t109 = L01744620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E0176F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E017695D0();
										L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0175f0d3
0x0175f0d9
0x0175f0e0
0x0175f0e7
0x0175f0f2
0x0175f0f4
0x0175f0f8
0x0175f100
0x0175f108
0x0175f10d
0x0175f115
0x0175f116
0x0175f11f
0x0175f123
0x0175f124
0x0175f12c
0x0175f130
0x0175f134
0x0175f13d
0x0175f144
0x0175f14b
0x0175f152
0x0179bab0
0x0179bab0
0x0175f158
0x0175f158
0x0175f15a
0x0175f160
0x0175f165
0x0175f166
0x0175f16f
0x0175f173
0x0179baa7
0x0179baa7
0x0179baab
0x00000000
0x0175f179
0x0175f18d
0x0175f191
0x0179baa2
0x00000000
0x0175f197
0x0175f19b
0x0175f1a2
0x0175f1a9
0x0175f1af
0x0175f1b2
0x0175f1b6
0x0175f1b9
0x0175f1c4
0x0175f1d8
0x0175f1df
0x0175f1e3
0x0175f1eb
0x0175f1ee
0x0175f1f4
0x0175f20f
0x0179bab7
0x0179babb
0x0179bacc
0x0179bad1
0x0175f215
0x0175f218
0x0175f226
0x0175f22b
0x00000000
0x0175f22b
0x0175f1f6
0x0175f1f6
0x0175f1f9
0x0175f1fb
0x0175f1fb
0x0175f1f4
0x0175f191
0x0175f173
0x0175f152
0x0175f203

Strings

@, xrefs: 0175F124

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 2a84a962c915fffa03329b69f4511eb9490debe772323dbad7c7018630595a99
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: B7517A71504711AFC321DF29C840A6BFBF8FF48750F00892AFA9597690E7B4E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017A3540 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E017A3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x181d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E01760BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E017A3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E0176FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E017A3540;
						E0176FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E0177DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E017B0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E017697C0();
					}
					return E0176B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E017A3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E017A3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E0176FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E01769650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E017A3787(_a4,  &_v352, _t80);
						}
					}
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E017695D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x017a3552
0x017a355a
0x017a355d
0x017a3566
0x017a3567
0x017a357e
0x017a358f
0x017a35a1
0x017a35a5
0x017a366b
0x017a366b
0x017a366d
0x017a3672
0x017a3679
0x017a3685
0x017a368d
0x017a369d
0x017a36a7
0x017a36b8
0x017a36c6
0x017a36c7
0x017a36dc
0x017a36e1
0x017a36e7
0x017a36e9
0x017a36e9
0x017a3703
0x017a3703
0x017a35b5
0x017a35c0
0x017a35c4
0x00000000
0x00000000
0x017a35ca
0x017a35d7
0x017a35e2
0x017a35e6
0x017a35e8
0x017a35f5
0x017a35fa
0x017a3603
0x017a3604
0x017a3609
0x017a360a
0x017a3612
0x017a3613
0x017a361e
0x017a3622
0x017a3628
0x017a362f
0x017a362f
0x017a3636
0x017a3638
0x017a363b
0x017a3642
0x017a3642
0x017a3636
0x017a3657
0x017a3657
0x017a365c
0x017a3662
0x017a3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 017A358F

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: faa5a16faaeb684a8c6c1efcd7e896abf20b51b697e16a552a63180736c605a4
Instruction ID: ae8190f2150caf97fa9b5e75254c166644f16a373bca5a5cba4de4491294d8e0
Opcode Fuzzy Hash: faa5a16faaeb684a8c6c1efcd7e896abf20b51b697e16a552a63180736c605a4
Instruction Fuzzy Hash: F34122B2D0052DABDB21DE50CC85FEEF77CAB54714F5046A5EB09AB240DB309E888F95

Uniqueness

Uniqueness Score: -1.00%

Function 017F05AC Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E017F05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E017F07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E01769730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E017EA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E017EA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E017F1293(_t79, _v40, E017F07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E01747D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E017E138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x017f05c5
0x017f05ca
0x017f05d3
0x017f06db
0x017f06db
0x017f06dd
0x017f06e3
0x017f06e3
0x017f05dd
0x017f05e7
0x017f05f6
0x017f0600
0x017f0607
0x017f0610
0x017f0615
0x017f061a
0x017f061c
0x017f061e
0x017f0624
0x017f0625
0x017f0627
0x017f0628
0x017f0631
0x017f0640
0x017f064d
0x017f0654
0x017f0654
0x017f0631
0x017f066d
0x017f0674
0x00000000
0x00000000
0x017f0692
0x017f069e
0x017f06b0
0x017f06a0
0x017f06a9
0x017f06a9
0x017f06b8
0x017f06d6
0x017f06d6
0x00000000

Strings

`, xrefs: 017F0633

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: c7e2034c25c340a704745a698a2f27d8fd41a50f060ac8fcda1afce84653e110
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: A131F332304346ABE710DE28CC89F97BBDAAB84754F144229FB549B381D770E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017A3884 Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E017A3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E01769650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L01744620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E01769650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x017a3893
0x017a3896
0x017a3899
0x017a389f
0x017a38a0
0x017a38a4
0x017a38a9
0x017a38ac
0x017a38ad
0x017a38ae
0x017a38af
0x017a38b1
0x017a38b4
0x017a38bb
0x017a38bc
0x017a38bd
0x017a38c4
0x017a38c8
0x017a38ca
0x017a38ca
0x017a38d5
0x017a393e
0x017a3940
0x017a3942
0x017a3952
0x017a3954
0x017a3961
0x017a3961
0x017a3967
0x017a396e
0x017a396e
0x017a3947
0x017a394c
0x00000000
0x017a394c
0x017a38ea
0x017a38ee
0x017a38f8
0x017a38f9
0x017a38ff
0x017a3900
0x017a3902
0x017a3903
0x017a390b
0x017a390f
0x017a3950
0x00000000
0x017a3950
0x017a3915
0x017a391d
0x017a391d
0x017a3922
0x017a3926
0x00000000
0x017a3928
0x017a392b
0x017a392b
0x017a3935
0x017a3937
0x017a3937
0x00000000
0x017a3935
0x017a3926
0x017a38f0
0x00000000

Strings

BinaryName, xrefs: 017A38B4

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: f1d49c8e4054a5e93462175e9fb768941830edc43daeb81b6cd8699c7f4f153c
Instruction ID: ff5c0280cf4c4ef7056b4e6361770a068e088ed3323ac48ae26c112b272c7cc5
Opcode Fuzzy Hash: f1d49c8e4054a5e93462175e9fb768941830edc43daeb81b6cd8699c7f4f153c
Instruction Fuzzy Hash: 1D31E33290061ABFEB16DE58C945E6BFB74FB80B28F514269EA15A7290D7309E04C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0175D294 Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0175D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x181d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E01744120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0176B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E017698D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E017695D0();
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0175d29c
0x0175d2a6
0x0175d2b1
0x0175d2b5
0x0175d2b6
0x0175d2bc
0x0175d2bd
0x0175d2be
0x0175d2bf
0x0175d2c2
0x0175d2c4
0x0175d2cc
0x0175d384
0x0175d34b
0x0175d34f
0x0175d350
0x0175d351
0x0175d35c
0x0175d35c
0x0175d2d6
0x0175d2da
0x0175d2e1
0x0175d361
0x0175d369
0x0175d36d
0x0175d2e3
0x0175d2e3
0x0175d2e3
0x0175d2e5
0x0175d2ed
0x0175d2f5
0x0175d2fa
0x0175d302
0x0175d303
0x0175d30b
0x0175d30f
0x0175d313
0x0175d318
0x0175d31c
0x0175d320
0x0175d379
0x0175d37d
0x00000000
0x00000000
0x0179affe
0x0179b001
0x0179b011
0x00000000
0x0175d322
0x0175d322
0x0175d330
0x0175d337
0x0175d35d
0x0175d339
0x0175d33f
0x0175d38c
0x0175d38c
0x0175d33f
0x0175d349
0x00000000
0x0175d349

Strings

@, xrefs: 0175D303

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: fb94343a18e794fd4a6673f43c93d1e8345fcf375884dc2acba68bf4fec3c054
Instruction ID: aa908d805bf428e61c0bb9e9316c3651895ab00387a780d1edd7c45b783fb51f
Opcode Fuzzy Hash: fb94343a18e794fd4a6673f43c93d1e8345fcf375884dc2acba68bf4fec3c054
Instruction Fuzzy Hash: 3331DFB2509301DFD361DF68C884A6BFBE8EB89654F00092EFD9483211E774DD08CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01731B8F Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01731B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E0176BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E0176A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E0176A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L01744620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x01731b8f
0x01731b9a
0x01731b9c
0x01731b9e
0x01731ba3
0x01787010
0x01787010
0x00000000
0x01731ba9
0x01731ba9
0x01731bae
0x00000000
0x01731bc5
0x01731bca
0x01731bcf
0x01731bd0
0x01731bd1
0x01731bd2
0x01731bd6
0x01731bdc
0x01731be0
0x01786ffc
0x01787000
0x00000000
0x01787006
0x01787009
0x01787009
0x01731be6
0x01731bec
0x01731c0b
0x01731c0b
0x01731c0c
0x01731c11
0x01731c12
0x01731c15
0x01731c1b
0x01731c1f
0x01731c31
0x01731c33
0x01787026
0x01787026
0x01731c21
0x01731c24
0x01731c24
0x01731bee
0x01731bee
0x01731bf2
0x01731c3a
0x01731bf4
0x01731bf4
0x01731c05
0x01731c05
0x01731c09
0x01731c3e
0x00000000
0x00000000
0x00000000
0x01731c09
0x01731bec
0x01731be0
0x01731bae
0x01731c2e

Strings

WindowsExcludedProcs, xrefs: 01731BC5

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 59aabd1df67ecbead24e52c76e32d320e6d1c169c83aa42d7d92db7bdcd86988
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 3221493B500228ABDF22AA59C844F5BFBACEFC0610F250461FE05DB201D634DC01D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 0174F716 Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0174F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x0174f71d
0x0174f722
0x0174f726
0x01794770
0x0174f765
0x0174f769
0x0174f769
0x0174f732
0x0179477a
0x00000000
0x0179477a
0x0174f738
0x0174f73a
0x0174f73c
0x0174f73f
0x0174f746
0x0174f778
0x0174f7a9
0x0174f7a9
0x0174f754
0x0174f75a
0x0174f75d
0x0174f75f
0x0174f761
0x0174f76f
0x0174f771
0x0174f771
0x0174f76f
0x0174f763
0x00000000
0x0174f763
0x0174f77d
0x0174f7a3
0x0174f7a5
0x00000000
0x0174f7a5
0x0174f77f
0x0174f782
0x0174f784
0x0174f786
0x00000000
0x00000000
0x00000000
0x0174f788
0x0174f748
0x0174f74d
0x0174f78d
0x0174f793
0x0174f7b7
0x0174f7bc
0x00000000
0x0174f7bc
0x0174f798
0x00000000
0x00000000
0x0174f79d
0x0174f7b0
0x00000000
0x0174f7b0
0x0174f79f
0x00000000
0x0174f74f
0x0174f74f
0x00000000
0x0174f74f

Strings

Actx , xrefs: 0174F73F

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 2e8a09d217aba964969a931114b58154735d09eb7d8731bf3db44bb47a7afa80
Instruction ID: 610b0cc4eb9a32e645cc3889051653f4115bdbac05314ce11088da053e3648da
Opcode Fuzzy Hash: 2e8a09d217aba964969a931114b58154735d09eb7d8731bf3db44bb47a7afa80
Instruction Fuzzy Hash: 031101347487028BFB27CE1C8990736F6D6EB96224FA5457AE462CB792DB7CC8018740

Uniqueness

Uniqueness Score: -1.00%

Function 017D8DF1 Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E017D8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x1800d50);
				E0177D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E017B5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = E0177DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				E0177DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0177D130(_t34, _t39, _t40);
			}

0x017d8df1
0x017d8df1
0x017d8df1
0x017d8df1
0x017d8df1
0x017d8df1
0x017d8df3
0x017d8df8
0x017d8dfd
0x017d8e00
0x017d8e0e
0x017d8e2a
0x017d8e36
0x017d8e38
0x017d8e3c
0x017d8e46
0x017d8e46
0x017d8e36
0x017d8e50
0x017d8e56
0x017d8e59
0x017d8e5c
0x017d8e60
0x017d8e67
0x017d8e6d
0x017d8e73
0x017d8e74
0x017d8eb1
0x017d8ebd

Strings

Critical error detected %lx, xrefs: 017D8E21

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: acbfbc76a75160e5c8701d3301a8191e5d4b37fdd57654e0f9e402f7c44461a2
Instruction ID: 93bbf593c0804c28b69ffe37a5fb4daf553e4a9ee9fdb2af60703119e96cf721
Opcode Fuzzy Hash: acbfbc76a75160e5c8701d3301a8191e5d4b37fdd57654e0f9e402f7c44461a2
Instruction Fuzzy Hash: A11135B1D15348DADF26DFA8C9097DCFBB0AB18314F24426EE569AB382C3744602CF15

Uniqueness

Uniqueness Score: -1.00%

Function 017F5BA5 Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E017F5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x1801178);
				E0177D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E017F4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E0176D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E017F5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x18160e8;
								if( *0x18160e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x18160e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E01769710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E01766DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E0176F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E0176F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E0176F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E0176FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E0176FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E0176F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E0176F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E017F4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E0177D130(_t427, _t494, _t511);
				}
			}

0x017f5ba5
0x017f5baa
0x017f5baf
0x017f5bb4
0x017f5bb6
0x017f5bbc
0x017f5bbe
0x017f5bc4
0x017f5bcd
0x017f5bd3
0x017f5bd6
0x017f5bdc
0x017f5be0
0x017f5be3
0x017f5beb
0x017f5bf2
0x017f5bf8
0x017f5bfe
0x017f5c04
0x017f5c0e
0x017f5c18
0x017f5c1f
0x017f5c25
0x017f5c2a
0x017f5c2c
0x017f5c32
0x017f5c3a
0x017f5c3f
0x017f5c42
0x017f5c48
0x017f5c5b
0x017f5c5b
0x017f5c2c
0x017f5cb7
0x017f5cb9
0x017f5cbf
0x017f5cc2
0x017f5cca
0x017f5ccb
0x017f5ccb
0x017f5cd1
0x017f5cd7
0x017f5cda
0x017f5ce1
0x017f5ce4
0x017f5ce7
0x017f5ced
0x017f5cf3
0x017f5cf9
0x017f5cff
0x017f5d08
0x017f5d0a
0x017f5d0e
0x017f5d10
0x00000000
0x00000000
0x017f5d16
0x017f5d1a
0x00000000
0x00000000
0x017f5d20
0x017f5d22
0x017f5d25
0x017f5d2f
0x017f5d2f
0x017f5d33
0x017f5d3d
0x017f5d49
0x017f5d4b
0x00000000
0x00000000
0x017f5d5a
0x017f5d5d
0x017f5d60
0x00000000
0x00000000
0x017f5d66
0x017f5d69
0x00000000
0x00000000
0x017f5d6f
0x017f5d6f
0x017f5d73
0x017f5d79
0x017f5d7f
0x017f5d86
0x017f5d95
0x017f5d98
0x017f5dba
0x017f5dcb
0x017f5dce
0x017f5dd3
0x017f5dd6
0x017f5dd8
0x017f5de6
0x017f5dec
0x017f5dee
0x017f5df1
0x017f5df3
0x017f635a
0x017f635a
0x00000000
0x017f635a
0x017f5dfe
0x017f5e02
0x017f5e05
0x017f5e07
0x017f5e10
0x017f5e13
0x017f5e1b
0x017f5e1c
0x017f5e21
0x017f5e22
0x017f5e23
0x017f5e25
0x017f5e2a
0x017f5e2c
0x017f5e2e
0x017f5e36
0x017f5e39
0x017f5e42
0x017f5e47
0x017f5e4d
0x017f5e54
0x017f5e54
0x017f5e54
0x017f5e2e
0x017f5e5c
0x017f5e5f
0x017f5e62
0x017f5e64
0x017f5e6b
0x017f5e70
0x017f5e7a
0x017f5e7a
0x017f5e7a
0x017f5e6b
0x017f5e7e
0x017f5e7f
0x017f5e7f
0x017f5e81
0x017f5e87
0x017f5e8b
0x017f5e8c
0x017f5e8c
0x017f5e8c
0x017f5e9a
0x017f5e9c
0x017f5ea2
0x017f5ea6
0x017f5f50
0x017f5f50
0x017f5f57
0x017f5f66
0x017f5f66
0x017f5f66
0x017f5f68
0x017f5f6a
0x017f63d0
0x00000000
0x017f5f70
0x017f5f70
0x017f5f91
0x017f5f9c
0x017f5f9e
0x017f5fa4
0x017f5fa6
0x017f638c
0x017f6392
0x017f63a1
0x017f63a7
0x017f63af
0x017f63af
0x017f63bd
0x017f63d8
0x00000000
0x017f63d8
0x017f5fac
0x017f5fb2
0x017f5fb4
0x017f5fbd
0x017f5fc6
0x017f5fce
0x017f5fd4
0x017f5fdc
0x017f5fec
0x017f5fed
0x017f5fee
0x017f5fef
0x017f5ff9
0x017f5ffa
0x017f5ffb
0x017f5ffc
0x017f6000
0x017f6004
0x017f6012
0x017f6012
0x017f6018
0x017f6019
0x017f601a
0x017f601b
0x017f601c
0x017f6020
0x017f6059
0x017f605c
0x017f6061
0x017f6061
0x017f6022
0x017f6022
0x017f6022
0x017f6025
0x017f602a
0x017f602b
0x017f6031
0x017f6037
0x017f6038
0x017f603e
0x017f6048
0x017f6049
0x017f604a
0x017f604b
0x017f604c
0x017f604d
0x017f6053
0x017f6054
0x017f6054
0x017f6062
0x017f6065
0x017f6067
0x017f606a
0x017f6070
0x017f6075
0x017f6076
0x017f6081
0x017f6087
0x017f6095
0x017f6099
0x017f609e
0x017f60a4
0x017f60ae
0x017f60b0
0x017f60b3
0x017f60b6
0x017f60b8
0x017f60ba
0x017f60ba
0x017f60ba
0x017f60ba
0x017f60be
0x017f60c0
0x017f60c5
0x017f60c5
0x017f60c5
0x017f60c6
0x017f60cd
0x017f6114
0x017f60cf
0x017f60cf
0x017f60d4
0x017f60d5
0x017f60da
0x017f60db
0x017f60e1
0x017f60e2
0x017f60e8
0x017f60f8
0x017f60fd
0x017f60fe
0x017f6102
0x017f6104
0x017f6107
0x017f6109
0x017f610b
0x017f610b
0x017f610b
0x017f610b
0x017f610f
0x017f610f
0x017f6117
0x017f611a
0x017f611f
0x017f6125
0x017f6134
0x017f6139
0x017f613f
0x017f6146
0x017f6148
0x017f614b
0x017f614d
0x017f614f
0x017f614f
0x017f614f
0x017f614f
0x017f6153
0x017f6159
0x017f6159
0x017f615c
0x017f6163
0x017f6169
0x017f616c
0x017f6172
0x017f6181
0x017f6186
0x017f6187
0x017f618b
0x017f6191
0x017f6195
0x017f61a3
0x017f61bb
0x017f61c0
0x017f61c3
0x017f61cc
0x017f61d0
0x017f61dc
0x017f61de
0x017f61e1
0x017f61e4
0x017f61e6
0x017f61e8
0x017f61e8
0x017f61e8
0x017f61e8
0x017f61e6
0x017f61ec
0x017f61f3
0x017f6203
0x017f6209
0x017f620a
0x017f6216
0x017f621d
0x017f6227
0x017f6241
0x017f6246
0x017f624c
0x017f6257
0x017f6259
0x017f625c
0x017f625e
0x017f6260
0x017f6260
0x017f6260
0x017f6260
0x017f625e
0x017f6264
0x017f6267
0x017f6269
0x017f6315
0x017f6315
0x017f631b
0x017f631e
0x017f6324
0x017f6327
0x017f632f
0x017f6330
0x017f6333
0x017f633a
0x017f633c
0x017f6335
0x017f6335
0x017f6335
0x017f633f
0x017f6342
0x017f634c
0x017f6352
0x017f6355
0x017f6355
0x017f6359
0x00000000
0x017f626f
0x017f6275
0x017f6275
0x017f6278
0x017f627e
0x017f627e
0x017f6281
0x017f6287
0x017f628d
0x017f6298
0x017f629c
0x017f62a2
0x017f629e
0x017f629e
0x017f629e
0x017f62a7
0x017f62a7
0x017f62aa
0x017f62b0
0x017f62f0
0x017f62f0
0x017f62f2
0x017f62f8
0x017f62fd
0x017f62b2
0x017f62b2
0x017f62b2
0x017f62b5
0x017f62dd
0x017f62e2
0x017f62e5
0x017f62b7
0x017f62b8
0x017f62bb
0x017f62bd
0x017f62c0
0x017f62c4
0x017f62cd
0x017f62cd
0x017f62c0
0x017f62bb
0x017f62b5
0x017f6302
0x017f6303
0x017f6305
0x017f6305
0x017f6305
0x017f630c
0x017f630c
0x00000000
0x017f627e
0x017f6269
0x017f5eac
0x017f5ebb
0x017f5ebe
0x017f5ecb
0x017f5ecb
0x017f5ece
0x017f5ece
0x017f5ed4
0x017f5ed7
0x017f5ed9
0x017f5edb
0x017f5edb
0x017f5ee1
0x017f5ee1
0x017f5ee3
0x017f5f20
0x017f5f20
0x017f5ee5
0x017f5ee5
0x017f5ee5
0x017f5ee8
0x017f5f11
0x017f5f18
0x017f5eea
0x017f5eea
0x017f5eed
0x017f5ef2
0x017f5ef8
0x017f5efb
0x017f5f0a
0x017f5f0a
0x017f5eed
0x017f5ee8
0x017f5f22
0x017f5f28
0x00000000
0x00000000
0x017f5f30
0x017f5f31
0x017f5f37
0x017f5f3a
0x017f5f3d
0x017f5f44
0x00000000
0x00000000
0x00000000
0x017f5f46
0x017f5f48
0x017f5f4d
0x00000000
0x017f5f4d
0x017f5dda
0x017f5ddf
0x00000000
0x017f5ddf
0x017f5dd8
0x017f5da7
0x017f5da9
0x017f5dac
0x017f5dae
0x00000000
0x017f5db4
0x017f5db4
0x00000000
0x017f5db4
0x017f5dae
0x017f5d88
0x017f5d8d
0x017f6363
0x017f6369
0x017f636a
0x017f6370
0x017f6372
0x017f637a
0x017f637b
0x017f637d
0x00000000
0x00000000
0x017f637f
0x017f6385
0x00000000
0x017f6385
0x017f5d38
0x017f5d3b
0x00000000
0x00000000
0x00000000
0x017f5d3b
0x017f5d27
0x017f5d29
0x00000000
0x00000000
0x00000000
0x017f6360
0x00000000
0x017f6360
0x017f5c10
0x017f5c10
0x017f63da
0x017f63e5
0x017f63e5

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0946c7b5d0db12d450ab563019a12a348f971a72264825dc3b3ca05bc37b3e1c
Instruction ID: 4665f801f2f3257bd47584552e8f72417374d22a58b6919e8c43e12fa0945b4d
Opcode Fuzzy Hash: 0946c7b5d0db12d450ab563019a12a348f971a72264825dc3b3ca05bc37b3e1c
Instruction Fuzzy Hash: 9E422B75910219CFDB24CF68C880BAAFBB1FF45304F1581AEEA49AB342D7759A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01744120 Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E01744120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x181d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0175F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E01746E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L01744620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E01746E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M017445F8))) {
												case 0:
													_v568 = 0x1701078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x17011c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L01744620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E0176F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E0176F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E017252A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0173EB70(1, 0x18179a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0173AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E017695D0();
																			L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E0176B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E01763D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E0176B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x01744128
0x01744135
0x0174413c
0x01744141
0x01744145
0x01744147
0x0174414e
0x01744151
0x01744159
0x0174415c
0x01744160
0x01744164
0x01744168
0x0174416c
0x0174417f
0x01744181
0x0174446a
0x0174446a
0x0174418c
0x01744195
0x01744199
0x01744432
0x01744439
0x0174443d
0x01744442
0x01744447
0x00000000
0x0174419f
0x017441a3
0x017441b1
0x017441b9
0x017441bd
0x017445db
0x017445db
0x00000000
0x017441c3
0x017441c3
0x017441ce
0x017441d4
0x0178e138
0x0178e13e
0x0178e169
0x0178e16d
0x0178e19e
0x0178e16f
0x0178e16f
0x0178e175
0x0178e179
0x0178e18f
0x0178e193
0x00000000
0x0178e199
0x00000000
0x0178e199
0x0178e193
0x00000000
0x00000000
0x00000000
0x017441da
0x017441da
0x017441df
0x017441e4
0x017441ec
0x01744203
0x01744207
0x0178e1fd
0x01744222
0x01744226
0x0178e1f3
0x0178e1f3
0x0174422c
0x0174422c
0x01744233
0x0178e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01744239
0x01744239
0x01744239
0x01744239
0x01744233
0x01744226
0x017441ee
0x017441ee
0x017441f4
0x01744575
0x0178e1b1
0x0178e1b1
0x00000000
0x0174457b
0x0174457b
0x01744582
0x0178e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x01744588
0x01744588
0x0174458c
0x0178e1c4
0x0178e1c4
0x00000000
0x01744592
0x01744592
0x01744599
0x0178e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0174459f
0x0174459f
0x017445a3
0x0178e1d7
0x0178e1e4
0x00000000
0x017445a9
0x017445a9
0x017445b0
0x0178e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x017445b6
0x017445b6
0x017445b6
0x00000000
0x017445b6
0x017445b0
0x017445a3
0x01744599
0x0174458c
0x01744582
0x00000000
0x00000000
0x00000000
0x00000000
0x017441f4
0x0174423e
0x01744241
0x017445c0
0x017445c4
0x00000000
0x017445ca
0x017445ca
0x00000000
0x0178e207
0x0178e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x017445d1
0x00000000
0x00000000
0x017445ca
0x00000000
0x01744247
0x01744247
0x01744247
0x01744249
0x01744249
0x01744249
0x01744251
0x01744251
0x01744257
0x0174425f
0x0174426e
0x01744270
0x0174427a
0x0178e219
0x0178e219
0x01744280
0x01744282
0x01744456
0x017445ea
0x00000000
0x017445f0
0x0178e223
0x00000000
0x0178e223
0x0174445c
0x0174445c
0x00000000
0x0174445c
0x00000000
0x01744288
0x0174428c
0x0178e298
0x01744292
0x01744292
0x0174429e
0x017442a3
0x017442a7
0x017442ac
0x0178e22d
0x017442b2
0x017442b2
0x017442b9
0x017442bc
0x017442c2
0x017442ca
0x017442cd
0x017442cd
0x017442d4
0x0174433f
0x0174433f
0x017442d6
0x017442d6
0x017442d9
0x017442dd
0x017442eb
0x0178e23a
0x017442f1
0x01744305
0x0174430d
0x01744315
0x01744318
0x0174431f
0x01744322
0x0174432e
0x0174433b
0x0174433b
0x00000000
0x0174432e
0x017442eb
0x0174434c
0x0174434e
0x01744352
0x01744359
0x0174435e
0x01744361
0x0174436e
0x0174438a
0x0174438e
0x01744396
0x0174439e
0x017443a1
0x017443ad
0x017443bb
0x017443bb
0x017443ad
0x0174436e
0x017443bf
0x017443c5
0x01744463
0x01744463
0x017443ce
0x017443d5
0x017443d9
0x017443df
0x01744475
0x01744479
0x01744491
0x01744491
0x01744479
0x017443e5
0x017443eb
0x017443f4
0x017443f6
0x017443f9
0x017443fc
0x017443ff
0x017444e8
0x017444ed
0x017444f3
0x0178e247
0x00000000
0x017444f9
0x01744504
0x01744508
0x0174450f
0x0178e269
0x00000000
0x01744515
0x01744519
0x01744531
0x01744534
0x01744537
0x0174453e
0x01744541
0x0174454a
0x0178e255
0x0178e255
0x0178e25b
0x0178e25e
0x0178e261
0x0178e261
0x01744555
0x01744559
0x0174455d
0x0178e26d
0x0178e270
0x0178e274
0x0178e27a
0x0178e27d
0x0178e28e
0x0178e28e
0x01744563
0x01744563
0x01744569
0x01744569
0x00000000
0x0174455d
0x0174450f
0x00000000
0x017444f3
0x017443ff
0x01744405
0x01744405
0x01744405
0x017442ac
0x0174428c
0x01744282
0x01744407
0x0174440d
0x0178e2af
0x0178e2af
0x01744413
0x01744413
0x00000000
0x017441d4
0x00000000
0x017441c3
0x017441bd
0x01744415
0x01744415
0x01744416
0x01744417
0x01744429
0x0174416e
0x0174416e
0x01744175
0x01744498
0x0174449f
0x0178e12d
0x00000000
0x0178e133
0x00000000
0x0178e133
0x017444a5
0x017444a5
0x017444aa
0x00000000
0x017444bb
0x017444ca
0x017444d6
0x017444d7
0x017444d8
0x017444e3
0x017444e3
0x017444aa
0x0174417b
0x0174417b
0x0174417b
0x00000000
0x0174417b
0x01744175
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4ec166f3dbe7e3be51b5c01c9c00c908fd83f8d036610aa35cfe5e09604c90
Instruction ID: 6b408ba1e9faeb6925d0b8fa8b018498b0f0f5c461c853689eade5bcd2ef4999
Opcode Fuzzy Hash: ee4ec166f3dbe7e3be51b5c01c9c00c908fd83f8d036610aa35cfe5e09604c90
Instruction Fuzzy Hash: A5F179706082118BD724DF29C484B7AFBE1BF98714F14896EF986CB291EB34D981DB52

Uniqueness

Uniqueness Score: -1.00%

Function 017520A0 Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E017520A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1818714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E01752EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E01752EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E017258EC(_t240);
									_t221 =  *0x1815cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1815cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E01764A2C(0x1816e40, 0x1764b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E01747D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1705c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E0175F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E0175F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E017A7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L01742400(_t267 + 0x20);
															}
															L01742400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E01752397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E01742280(_t134, 0x1818608);
									__eflags =  *0x1816e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E0173FFB0(_t198, _t241, 0x1818608);
										__eflags = _t253;
										if(_t253 != 0) {
											L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1816e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1818608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E01756B90(_t210,  &_v64);
										_t262 =  *0x1818608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E0175E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E017697C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E0176006A(0x1818608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1818608);
												E0176B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1816904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1816e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E0173FFB0(_t198, _t240, 0x1818608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E017600C2(0x1818608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x017520a0
0x017520a8
0x017520ad
0x017520b3
0x017520b8
0x017520c2
0x017520c7
0x017520cb
0x017520d2
0x01752263
0x01752266
0x01795836
0x01795836
0x00000000
0x0175226c
0x0175226c
0x01752270
0x01752274
0x017520e2
0x017520e2
0x017520e6
0x017520ee
0x017957dc
0x017957de
0x017957ec
0x017957ec
0x017957f1
0x017957f3
0x017957f8
0x00000000
0x017957f8
0x017957e0
0x017957e4
0x017957ea
0x00000000
0x00000000
0x00000000
0x017957ea
0x017520f4
0x017520f4
0x017520f8
0x017520f8
0x017520fc
0x01752100
0x01752106
0x01752201
0x01752206
0x0175220b
0x0175220e
0x017522a9
0x017522ac
0x00000000
0x00000000
0x017522b2
0x017522b5
0x01795801
0x01795806
0x00000000
0x00000000
0x01795810
0x01795815
0x01795818
0x00000000
0x00000000
0x0179581e
0x017522bb
0x017522bb
0x01752218
0x01752218
0x0175221c
0x01752220
0x01752222
0x017522c2
0x017522c4
0x017522dc
0x017522dc
0x017522e1
0x00000000
0x00000000
0x00000000
0x017522e7
0x017522c8
0x017522cd
0x017522d3
0x017522d6
0x01795823
0x01795825
0x01795827
0x00000000
0x00000000
0x0179582d
0x00000000
0x0179582d
0x00000000
0x01752228
0x01752228
0x00000000
0x01752228
0x01752222
0x01752214
0x01752214
0x00000000
0x01752114
0x01752114
0x01752114
0x0175211a
0x0175211c
0x01752348
0x0175234d
0x01795840
0x01795845
0x01795848
0x0179584e
0x0179584e
0x01795848
0x01752353
0x01752355
0x01752388
0x01752388
0x01752368
0x0175236a
0x0175236c
0x0175238f
0x00000000
0x0175236e
0x0175236e
0x0175218e
0x0175218e
0x01752191
0x01752195
0x01795a03
0x01795a06
0x01795a0c
0x01795a0f
0x01795a11
0x01795a13
0x01795a13
0x01795a19
0x01795a1f
0x00000000
0x0175219b
0x0175219b
0x017521a0
0x01752282
0x01752284
0x01752284
0x01752284
0x01752284
0x017521a6
0x017521a9
0x017521ac
0x017521ae
0x017521b3
0x0175228b
0x01752290
0x01752379
0x01752296
0x01752298
0x01752298
0x01752290
0x017521b9
0x017521be
0x017522a2
0x017522a2
0x017521c4
0x017521c8
0x017521cc
0x017521d0
0x017521d4
0x017521de
0x017521e3
0x01795a29
0x01795a2c
0x00000000
0x00000000
0x01795a3b
0x00000000
0x017521e9
0x017521e9
0x017521e9
0x017521ee
0x017521f1
0x01795a45
0x01795a4b
0x01795a52
0x01795a58
0x01795a5d
0x01795a5f
0x01795a71
0x01795a61
0x01795a6a
0x01795a6a
0x01795a76
0x01795a79
0x01795a7f
0x01795a83
0x01795a85
0x01795a87
0x01795a87
0x01795a8c
0x01795a91
0x01795a97
0x01795a9f
0x01795aa0
0x01795aa1
0x01795aa6
0x01795aab
0x01795ab1
0x01795ab3
0x01795ab9
0x01795aca
0x01795ad4
0x01795ad4
0x01795ade
0x01795ade
0x01795aab
0x01795a79
0x01795a52
0x017521f7
0x017521f9
0x017521fe
0x017521fe
0x017521e3
0x01752195
0x0175236c
0x01752122
0x01752122
0x01752124
0x01752231
0x01752236
0x01752236
0x01752238
0x01752238
0x01752240
0x01752242
0x01752244
0x017959fc
0x0175218c
0x0175218c
0x00000000
0x0175218c
0x0175224a
0x0175224f
0x01752256
0x01752304
0x01752309
0x0175230f
0x0175231e
0x0175231e
0x0175231e
0x01752320
0x01752325
0x0175232a
0x0175232c
0x0175233e
0x0175233e
0x00000000
0x0175232c
0x01752311
0x01752317
0x0175231a
0x0175231c
0x01752380
0x01752380
0x01752380
0x01752384
0x00000000
0x00000000
0x01752386
0x00000000
0x0175231c
0x0175225c
0x0175225c
0x00000000
0x0175225c
0x0175212a
0x01752134
0x01752138
0x0175213d
0x01795858
0x01795863
0x01795863
0x01795867
0x0179586a
0x00000000
0x00000000
0x0179586c
0x0179586c
0x01795871
0x01795875
0x01795877
0x01795997
0x0179599c
0x017959a1
0x017959a7
0x017959a7
0x00000000
0x017959a7
0x0179587d
0x00000000
0x0179588b
0x0179588b
0x01795890
0x01795892
0x01795894
0x01795899
0x0179589b
0x017958a0
0x017958a0
0x017958aa
0x017958b2
0x017958b6
0x017958be
0x017958c6
0x017958c9
0x0179590d
0x01795917
0x0179591a
0x0179591c
0x01795920
0x01795928
0x0179592a
0x0179592c
0x0179592e
0x0179592e
0x017958cb
0x017958cd
0x017958d8
0x017958e0
0x017958f4
0x017958fe
0x017958fe
0x0179593a
0x0179593e
0x01795940
0x01795942
0x00000000
0x01795944
0x01795944
0x01795949
0x0179594e
0x0179594e
0x01795953
0x0179595b
0x01795976
0x01795976
0x0179597a
0x0179597f
0x00000000
0x00000000
0x00000000
0x00000000
0x01795981
0x01795981
0x01795981
0x01795983
0x01795988
0x0179598d
0x01795991
0x01795991
0x00000000
0x0179595d
0x0179595d
0x01795963
0x01795965
0x00000000
0x00000000
0x00000000
0x00000000
0x01795967
0x01795967
0x0179596b
0x0179596d
0x00000000
0x00000000
0x0179596f
0x01795971
0x01795971
0x01795974
0x00000000
0x00000000
0x00000000
0x01795974
0x00000000
0x01795967
0x0179595b
0x01795942
0x01795863
0x01752143
0x01752143
0x01752149
0x0175214f
0x017522f1
0x017522f6
0x00000000
0x01752173
0x01752173
0x0175217d
0x01752181
0x01752186
0x017959ae
0x017959b2
0x017959b5
0x017959b7
0x017959ba
0x017959cd
0x017959d1
0x017959d5
0x017959d9
0x017959db
0x00000000
0x00000000
0x017959dd
0x017959dd
0x017959e1
0x017959e4
0x017959e7
0x017959ee
0x017959ee
0x017959f3
0x017959f3
0x00000000
0x01752186
0x0175214f
0x01752106
0x01752266
0x017520d8
0x017520da
0x017520e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d360ce1d66dbb08b2bb6e4e99e1a6c630bd21c12a39cdfa3ee27d368bd753a2
Instruction ID: 4325d93a4a7b7a8851186600f32986f237f1e8e08056eec0c80a045af7901fd5
Opcode Fuzzy Hash: 1d360ce1d66dbb08b2bb6e4e99e1a6c630bd21c12a39cdfa3ee27d368bd753a2
Instruction Fuzzy Hash: E9F10135608301DFEB66CB2CC84472BFBE5AF85364F04855EED999B282D7B4D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0173849B Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0173849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x17ff9c0);
				E0177D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x1817b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E0173CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E01742280( *[fs:0x30], 0x1818550);
						_t139 =  *0x1817b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E0175F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E0173FFB0(_t193, _t235, 0x1818550);
								L5:
								return E0177D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E01721C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x1817b9c; // 0x0
							_t235 = L01744620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x1817b10; // 0x0
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E0175A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E0173FFB0(_t193, _t235, 0x1818550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L017477F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L017477F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x1817b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x1817b10; // 0x0
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E017637C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x1817b9c; // 0x0
									_t214 = L01744620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E017637F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x1817b10 =  *0x1817b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x1817b04 =  *0x1817b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L017477F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L017477F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x1817b08 =  *0x1817b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E017657C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E0176F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L017477F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E0175A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L017477F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E017696C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x0173849b
0x0173849b
0x0173849b
0x0173849b
0x0173849d
0x017384a2
0x017384a7
0x017384b1
0x017384d8
0x00000000
0x017384b3
0x017384c4
0x017384c9
0x017384cd
0x017384cf
0x017384cf
0x017384d6
0x017384e6
0x017384e9
0x017384ec
0x017384ef
0x017384f2
0x017384f4
0x017384fc
0x01738501
0x01738506
0x01738509
0x017386e0
0x017386e5
0x017386e8
0x017386ed
0x017386f0
0x017386f2
0x01789afd
0x01789b02
0x017384da
0x017384df
0x017384df
0x017386fa
0x017386fd
0x017386fe
0x01738701
0x01738706
0x01738709
0x0173870b
0x00000000
0x00000000
0x01738711
0x01738725
0x01738727
0x0173872a
0x0173872c
0x01789af0
0x01789af5
0x01738732
0x01738732
0x01738732
0x01738735
0x01738737
0x01738515
0x01738515
0x01738518
0x0173851d
0x01738523
0x01738527
0x0173852b
0x01738537
0x01738539
0x0173853c
0x0173853e
0x0173868c
0x01738691
0x01738699
0x0173869b
0x01738744
0x01738748
0x017386a1
0x017386a1
0x017386a1
0x017386a4
0x017386a8
0x01789bdf
0x01789bdf
0x017386ae
0x017386b0
0x00000000
0x017386b6
0x00000000
0x01789be9
0x017386b0
0x01738544
0x0173854a
0x0173854d
0x01738551
0x0173876e
0x01738778
0x0173877b
0x01738780
0x01738557
0x01738557
0x0173855d
0x0173855d
0x0173856b
0x0173856e
0x01738570
0x01738573
0x01738576
0x01738576
0x01738579
0x0173857b
0x00000000
0x00000000
0x01738581
0x017385a0
0x017385a2
0x017385a5
0x017385a7
0x01789b1b
0x01789b1b
0x0173862e
0x0173862e
0x01738631
0x01738631
0x01738634
0x01738636
0x01738669
0x01738669
0x0173866b
0x01789bbf
0x01789bc4
0x01789bc8
0x01789bce
0x01789bce
0x01738671
0x01738671
0x01738674
0x01738676
0x01789bae
0x01789bae
0x01738676
0x0173867c
0x0173867e
0x01738688
0x01738688
0x00000000
0x0173867e
0x01738638
0x01738638
0x0173863b
0x0173863e
0x0173863f
0x01738642
0x01738645
0x01738648
0x0173864d
0x01789b69
0x01789b6e
0x01789b7b
0x01789b81
0x01789b85
0x01789b89
0x01789ba7
0x01789b8b
0x01789b91
0x01789b9a
0x01789b9f
0x01789b9f
0x01738788
0x0173878d
0x01738763
0x01738763
0x01738766
0x00000000
0x01738766
0x01789b70
0x00000000
0x01789b70
0x01738656
0x0173865a
0x0173865c
0x01738752
0x01738756
0x00000000
0x00000000
0x0173875e
0x00000000
0x0173875e
0x01738662
0x01738662
0x01738662
0x01738666
0x00000000
0x01738666
0x017385b7
0x017385b9
0x017385bc
0x017385bf
0x017385cc
0x017385d1
0x017385d4
0x017385db
0x017385de
0x017385e0
0x01789b5f
0x00000000
0x01789b5f
0x017385e6
0x017385ea
0x017386c3
0x017386c5
0x017386c8
0x017386ca
0x01789b16
0x00000000
0x01789b16
0x017386d6
0x017385f6
0x017385f6
0x017385f9
0x01738602
0x01738606
0x0173860a
0x0173860b
0x0173860e
0x01738611
0x00000000
0x01738611
0x017385f3
0x00000000
0x017385f3
0x01738619
0x0173861e
0x0173861e
0x01738621
0x01738622
0x01738623
0x01738625
0x0173862c
0x00000000
0x0173873d
0x00000000
0x0173873d
0x01738737
0x0173850f
0x01738512
0x00000000
0x01738512
0x00000000
0x017384d6

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9ea8ae661262532b014955666de60117e51c207a2fbf56c7cd89f6ce4f96d7
Instruction ID: 651b83e4cced70ccbe931b2ec8a885c637ab7e3e104854b53a077f7ae6bc17bd
Opcode Fuzzy Hash: fc9ea8ae661262532b014955666de60117e51c207a2fbf56c7cd89f6ce4f96d7
Instruction Fuzzy Hash: 16B13CB1E00209DFDB15DFE9C984AADFBB9BF88304F10422AE505AB346D774A945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0172C600 Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0172C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x181d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E01736D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E0176B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x1817b9c; // 0x0
					_t74 = L01744620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E01769650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L017477F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E0176F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E017613C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L017477F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E01769650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x0172c608
0x0172c615
0x0172c625
0x0172c62d
0x0172c635
0x0172c640
0x0172c680
0x0172c687
0x0172c688
0x0172c689
0x0172c694
0x0172c694
0x0172c642
0x0172c64a
0x0172c697
0x01797a25
0x01797a2b
0x01797a2e
0x01797a30
0x01797bea
0x01797bea
0x00000000
0x01797bea
0x01797a36
0x01797a43
0x01797a48
0x01797a4c
0x01797a4e
0x00000000
0x00000000
0x01797a58
0x01797a5a
0x01797a5b
0x01797a5c
0x01797a5d
0x01797a63
0x01797a64
0x01797a6a
0x01797a6c
0x01797a6e
0x017979cb
0x017979cb
0x017979ce
0x017979d0
0x01797a98
0x01797a9b
0x01797a9b
0x01797a9e
0x01797aa1
0x01797bbe
0x01797bbe
0x01797bc0
0x01797be0
0x01797be0
0x01797a01
0x01797a01
0x01797a05
0x01797a07
0x01797a15
0x01797a15
0x01797a1a
0x00000000
0x01797a1a
0x01797bc2
0x01797bc6
0x01797bc9
0x01797bcd
0x01797bcf
0x017979e6
0x017979e6
0x017979eb
0x017979eb
0x017979ef
0x017979f1
0x00000000
0x00000000
0x017979f3
0x017979f5
0x017979ff
0x017979ff
0x00000000
0x017979ff
0x017979f7
0x017979fd
0x00000000
0x00000000
0x00000000
0x017979fd
0x01797bd5
0x01797bd8
0x00000000
0x00000000
0x01797ba9
0x01797bac
0x01797bb0
0x01797bb1
0x01797bb1
0x01797bb6
0x00000000
0x01797bb6
0x01797aa7
0x01797aaa
0x00000000
0x00000000
0x01797ab2
0x01797ab3
0x01797ab5
0x01797aec
0x01797aef
0x01797b25
0x01797b28
0x01797b62
0x01797b64
0x01797b8f
0x01797b92
0x01797b96
0x01797b98
0x00000000
0x00000000
0x01797b9e
0x01797b9f
0x01797ba3
0x00000000
0x01797ba3
0x01797b66
0x01797b68
0x01797ae2
0x01797ae2
0x00000000
0x01797ae2
0x01797b6e
0x01797b72
0x01797b75
0x01797b81
0x01797b85
0x01797b87
0x00000000
0x00000000
0x01797b31
0x01797b34
0x01797b3c
0x01797b45
0x01797b46
0x01797b4f
0x01797b51
0x01797b57
0x01797b59
0x01797b59
0x00000000
0x01797b59
0x01797b77
0x00000000
0x01797b77
0x01797b2a
0x00000000
0x01797b2a
0x01797af1
0x01797af3
0x00000000
0x00000000
0x01797afb
0x01797afc
0x01797afe
0x00000000
0x00000000
0x01797b00
0x01797b03
0x00000000
0x00000000
0x01797b05
0x01797b09
0x01797b0d
0x01797b0f
0x00000000
0x00000000
0x01797b18
0x01797b1d
0x00000000
0x01797b1d
0x01797ab7
0x01797ab9
0x00000000
0x00000000
0x01797abf
0x01797ac1
0x00000000
0x00000000
0x01797ac3
0x01797ac6
0x00000000
0x00000000
0x01797ac8
0x01797acc
0x01797ad0
0x01797ad2
0x00000000
0x00000000
0x01797adb
0x00000000
0x01797adb
0x017979d6
0x017979d9
0x017979dc
0x01797a91
0x01797a94
0x00000000
0x01797a94
0x017979e2
0x00000000
0x017979e2
0x01797a74
0x01797a7a
0x00000000
0x00000000
0x01797a8a
0x01797a21
0x01797a21
0x00000000
0x01797a21
0x0172c650
0x0172c651
0x0172c656
0x0172c65c
0x0172c65d
0x0172c663
0x0172c664
0x0172c66a
0x0172c66e
0x017979c5
0x017979c7
0x00000000
0x017979c7
0x0172c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73246206bf944d5f16f39841432867029a5a2b90d9731a06714467da5b297d62
Instruction ID: 984133742bb17bc12f72a7ed4b0bf65033870e905860df3033ec48f4107a38aa
Opcode Fuzzy Hash: 73246206bf944d5f16f39841432867029a5a2b90d9731a06714467da5b297d62
Instruction Fuzzy Hash: 3081B3756242018BDF2ACF58D880B6AF7E8FF84350F14495AEE459B241D334DE49CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 017BB8D0 Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E017BB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x1817b9c; // 0x0
				_t124 = L01744620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E01769800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E017695B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E017695D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L017477F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E01769910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E017695D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x1817b9c; // 0x0
									_t92 = L01744620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E01769910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0172A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E017BE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E017BE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E017695B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x017bb8d9
0x017bb8e4
0x00000000
0x017bb8e6
0x017bb8f3
0x017bb8f5
0x017bb8f5
0x017bb8f8
0x017bb920
0x017bb924
0x017bb936
0x017bb939
0x017bb93d
0x017bb948
0x017bb9a0
0x017bb9a0
0x017bb9a4
0x017bb9bf
0x017bb9c4
0x017bb9c6
0x017bb9cd
0x017bb9d1
0x017bbad4
0x017bbad8
0x017bbada
0x017bbadc
0x017bbadc
0x017bbadf
0x017bbae0
0x017bbae2
0x017bbae4
0x017bbaec
0x017bbaee
0x017bbaf0
0x017bbaf0
0x017bbaec
0x017bbafb
0x017bbafc
0x017bbafe
0x017bbb01
0x017bbb01
0x00000000
0x017bbb06
0x017bb9d7
0x017bb9db
0x017bb9db
0x017bb9de
0x017bb9de
0x017bb9e4
0x017bb9e7
0x017bb9ea
0x017bb9ec
0x017bb9ef
0x017bb9f3
0x017bba1b
0x017bba1b
0x017bba23
0x017bba24
0x017bba27
0x017bba2a
0x017bba2b
0x017bba2e
0x017bba30
0x017bba37
0x017bba3f
0x017bba9c
0x017bbaa2
0x017bbb13
0x017bbb15
0x017bbaae
0x017bbaae
0x017bbab3
0x017bbab5
0x017bbaba
0x017bbac8
0x017bbac8
0x017bbaba
0x017bbacd
0x017bbacf
0x00000000
0x017bbacf
0x017bbb1a
0x00000000
0x017bbb1c
0x017bbaa7
0x017bbb11
0x00000000
0x017bbb11
0x017bbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x017bba41
0x017bba41
0x017bba41
0x017bba58
0x017bba5d
0x017bba62
0x00000000
0x00000000
0x017bba64
0x017bba67
0x017bba68
0x017bba69
0x017bba6c
0x017bba6f
0x017bba71
0x017bba78
0x017bba80
0x00000000
0x00000000
0x017bba90
0x017bba90
0x017bba97
0x00000000
0x017bba97
0x017bb9f5
0x017bb9f7
0x017bb9f7
0x017bb9fa
0x017bba03
0x017bba07
0x017bba0c
0x017bba10
0x017bba17
0x00000000
0x017bb9f7
0x017bb9a6
0x017bb9a8
0x017bb9af
0x017bb9b3
0x00000000
0x00000000
0x017bb9b9
0x00000000
0x017bb9b9
0x017bb94d
0x017bb98f
0x017bb995
0x017bb999
0x017bb960
0x017bb967
0x017bb968
0x017bb96a
0x00000000
0x017bb96a
0x017bb99b
0x017bb99e
0x00000000
0x00000000
0x00000000
0x017bb99e
0x017bb951
0x017bb954
0x017bb95a
0x017bb95e
0x017bb972
0x017bb979
0x017bb97d
0x017bb97f
0x017bb980
0x017bb982
0x017bb984
0x00000000
0x017bb984
0x00000000
0x017bb926
0x00000000
0x017bb926

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91270d091ecde4adc862b933ef8b4ebd9f5db57991aec037feac4602b868ecff
Instruction ID: 2b9b8f43aaf3c31fb3bb948d16c2d283af88d7f0af41d39d8bffb3f13ae13c4d
Opcode Fuzzy Hash: 91270d091ecde4adc862b933ef8b4ebd9f5db57991aec037feac4602b868ecff
Instruction Fuzzy Hash: 6771E232640702EFE732DF28CC89F96FBE5EB44720F144928EA55876A1DB75EA44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 017A6DC9 Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E017A6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E017A6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E01747D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E01769AE0();
					_t87 = L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E017A795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E017A795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E017A795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E017A795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L01744620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E017A6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E017A6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E017A6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E017A6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E01747D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E01769AE0();
								L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L01742400( &_v36);
							if(_v24 >= 0) {
								_t87 = L01742400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L01742400( &_v52);
							}
							if(_v28 >= 0) {
								return L01742400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x017a6dd4
0x017a6dde
0x017a6de1
0x017a6de3
0x017a6de6
0x017a6de9
0x017a6dec
0x017a6def
0x017a6df2
0x017a6df5
0x017a6dfe
0x017a6e04
0x017a6e09
0x017a6e0d
0x017a6e18
0x017a6e1b
0x017a6e22
0x017a6e2d
0x017a6e30
0x017a6e36
0x017a6e42
0x017a6e4d
0x017a6e50
0x017a6e55
0x017a6e5c
0x017a6e6e
0x017a6e5e
0x017a6e67
0x017a6e67
0x017a6e73
0x017a6e74
0x017a6e77
0x017a6e7c
0x017a6e7d
0x017a6e8e
0x017a6e93
0x017a6e9c
0x017a6ea8
0x017a6eab
0x017a6eac
0x017a6eb3
0x017a6ecd
0x017a6edc
0x017a6ee2
0x017a6ee5
0x017a6ef2
0x017a6efb
0x017a6f01
0x017a6f06
0x017a6f0b
0x017a6f11
0x017a6f1a
0x017a6f22
0x017a6f26
0x017a6f26
0x017a6f33
0x017a6f41
0x017a6f44
0x017a6f47
0x017a6f54
0x017a6f65
0x017a6f77
0x017a6f7c
0x017a6f82
0x017a6f91
0x017a6f99
0x017a6fa3
0x017a6fae
0x017a6fae
0x017a6fba
0x017a6fbb
0x017a6fbc
0x017a6fc1
0x017a6fc2
0x017a6fd3
0x017a6fd8
0x017a6fd8
0x017a6fdf
0x017a6fe8
0x017a6fee
0x017a6fee
0x017a6ff5
0x017a6ffb
0x017a6ffb
0x017a7004
0x00000000
0x017a700a
0x017a7004
0x017a6eb3
0x017a6e9c
0x017a7015

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 05420d7912f9e8d60eb974b55cf056b74858337dd3f7d9eaca32781993069cf1
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 89718F71A00209EFDB14DFA8C988AEEFBB9FF88704F544569E505E7250DB30AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017252A5 Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E017252A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0173EEF0(0x18179a0);
					_t104 =  *0x1818210; // 0x1122ce0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E0173EB70(_t93, 0x18179a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E01769890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0173EEF0(0x18179a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0173EB70(0, 0x18179a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x1122ced
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0175F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0173EEF0(0x18179a0);
									__eflags =  *0x1818210 - _t104; // 0x1122ce0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x1818210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E017A4888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E0173EB70(_t95, 0x18179a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E017695D0();
											L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E017695D0();
											L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0173EB70(_t93, 0x18179a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E017695D0();
										L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E017695D0();
										L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0175F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x017252a5
0x017252ad
0x017252b0
0x017252b3
0x017252b7
0x017252ba
0x017252bf
0x017252c4
0x017252cc
0x00000000
0x00000000
0x017252ce
0x017252d9
0x017252dd
0x017252e7
0x017252f7
0x017252f9
0x017252fd
0x01780dcf
0x01780dd5
0x01780dd6
0x01780dd7
0x01780dd8
0x01780dd9
0x01780dde
0x01780ddf
0x01780de0
0x01780de1
0x01780de2
0x01780de5
0x01780dea
0x01780dec
0x01780f60
0x01780f64
0x01780f70
0x01780f76
0x01780f79
0x01780f79
0x00000000
0x01780f64
0x01780df2
0x01780df7
0x01780e04
0x01780e0d
0x01780e0d
0x01780e10
0x01780e1a
0x01780e1c
0x01780e4c
0x01780e52
0x01780e61
0x01780e67
0x01780e6b
0x01780e70
0x01780e76
0x01780ed7
0x01780edc
0x01780ee0
0x01780ee6
0x01780eea
0x01780eed
0x01780ef0
0x01780ef3
0x01780ef6
0x01780ef9
0x01780efe
0x01780f01
0x01780f01
0x01780f0b
0x01780f12
0x01780f16
0x01780f18
0x01780f1b
0x01780f2c
0x01780f31
0x01780f31
0x01780f35
0x01780f39
0x01780f3a
0x01780f3c
0x01780f3f
0x01780f50
0x01780f55
0x01780f55
0x01780f59
0x017252eb
0x017252f1
0x017252f1
0x01780e7d
0x01780e84
0x01780e88
0x01780e8a
0x01780e8d
0x01780e9e
0x01780ea3
0x01780ea3
0x01780ea7
0x01780eaf
0x01780eb3
0x01780eb9
0x01780eb9
0x01780ebc
0x01780ecd
0x01780ecd
0x00000000
0x01780eb3
0x01780e21
0x01780e2b
0x01780e2f
0x01780e30
0x01780e3a
0x01780e3f
0x01780e41
0x00000000
0x00000000
0x01780e47
0x00000000
0x01780e47
0x01780df9
0x01780dfe
0x00000000
0x00000000
0x00000000
0x01780dfe
0x01725303
0x01725307
0x00000000
0x01725309
0x00000000
0x01725309
0x01725307
0x017252e9
0x017252e9
0x00000000
0x017252e9
0x0172530e
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74e8a3606683d63f5bde8c68e06cf4cea0f025496f2f75b7c1fc76994c1f537
Instruction ID: 84faab450b12730e90aa66159f33ddfc997265d8a0c816e04d49f09328b35bd2
Opcode Fuzzy Hash: c74e8a3606683d63f5bde8c68e06cf4cea0f025496f2f75b7c1fc76994c1f537
Instruction Fuzzy Hash: A651CC71245342ABD322EF28C844B67FBE8FF94710F14091EF59587692E774E849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01752AE4 Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01752AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x1818204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x1818208; // 0x1818207
				_t8 = _t57 + 0x1818208; // 0x1818207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x1818450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x181821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x1816d5c; // 0x7f620654
							_t72 =  *0x1816d5c; // 0x7f620654
							_t75 =  *0x1816d5c; // 0x7f620654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x1816d5c; // 0x7f620654
							_t84 =  *0x1816d5c; // 0x7f620654
							_t87 =  *0x1816d5c; // 0x7f620654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E0176F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x01752ae4
0x01752aec
0x01752aef
0x01752af4
0x01752af7
0x01752afd
0x01752b92
0x01752b92
0x01752b97
0x01752b9c
0x01752b9c
0x01752b03
0x01752b06
0x01752b09
0x01752b09
0x01752b0f
0x01752b15
0x01752b15
0x01752b1b
0x01752b1e
0x01752b21
0x01752b26
0x01752b29
0x01752b81
0x01752b84
0x01752c0e
0x01752c15
0x01752c24
0x01752c24
0x01752b8a
0x01752b8a
0x01752b8a
0x01752b8a
0x01752b90
0x00000000
0x00000000
0x00000000
0x00000000
0x01752b4a
0x01752b4a
0x01752b4d
0x01752b53
0x00000000
0x00000000
0x01752b55
0x01752b58
0x01752bb7
0x01795d1b
0x01795d37
0x01795d47
0x01795d53
0x01752bbd
0x01752bbd
0x01752bbd
0x01752bb7
0x01752b5d
0x01752c2f
0x01795d5b
0x01795d77
0x01795d87
0x01795d93
0x01752c35
0x01752c35
0x01752c35
0x01752c2f
0x01752b65
0x01752b9f
0x01752ba2
0x01752b67
0x01752b67
0x01752b69
0x01752b6b
0x01752b6e
0x01752bc9
0x01752bcc
0x01752bcf
0x01752bd4
0x01752bd6
0x01752bd6
0x01752bdb
0x01752c02
0x01752c05
0x01752c07
0x00000000
0x01752c07
0x01752be0
0x01752c00
0x01752c3f
0x01752c3f
0x00000000
0x01752c00
0x01752be5
0x01752be7
0x01752bec
0x01752bf4
0x01752bf6
0x00000000
0x01752bf6
0x01752b70
0x01752b76
0x01752b2b
0x01752b2b
0x01752b2d
0x01752b2f
0x01752b32
0x01752b35
0x01752b3a
0x00000000
0x01752b40
0x01752b43
0x01752b45
0x01752b47
0x01752b4a
0x01752b4d
0x01752b53
0x00000000
0x00000000
0x00000000
0x01752b53
0x01752b78
0x01752b78
0x01752b7b
0x01752b7e
0x00000000
0x01752b7e
0x01752b76
0x01752ba5
0x01752ba5
0x01752ba8
0x01752bad
0x00000000
0x00000000
0x01752baf
0x01752baf
0x01752bc2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be57b74735be84e875d6f20991a64c5b2bd17796b794d460fce37830574b45c4
Instruction ID: e2980c11b326274dd4395e022021f441c231a0e8d1aaa34db71f68ebe85c7ae6
Opcode Fuzzy Hash: be57b74735be84e875d6f20991a64c5b2bd17796b794d460fce37830574b45c4
Instruction Fuzzy Hash: C351A176B00125CFCB59CF1CC8909BDF7B5FB88700715855AEC46AB326E7B0AA51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017EAE44 Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E017EAE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E017EC38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E017EACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E017EFDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E017EEA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E01747D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E017E1608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E017F1536(0x1818ae4, (_t74 -  *0x1818b04 >> 0x14) + (_t74 -  *0x1818b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L017EC323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E017EA80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E017CCB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E017EACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x017eae44
0x017eae4c
0x017eae53
0x017eae55
0x017eae5c
0x017eae64
0x017eae68
0x017eae75
0x017eae75
0x017eae78
0x017eae7a
0x017eae7c
0x017eae7f
0x017eaea8
0x017eaeab
0x017eaead
0x00000000
0x00000000
0x017eaeb3
0x017eaeb8
0x017eaebb
0x017eaebd
0x00000000
0x017eae81
0x017eae88
0x017eae8f
0x017eae9b
0x017eae96
0x017eae96
0x017eae96
0x017eaea0
0x017eaea3
0x017eaebf
0x017eaebf
0x017eaec3
0x017eaec9
0x017eaf0d
0x017eaf14
0x017eaf3d
0x017eaf3d
0x017eaf41
0x017eaf44
0x017eaf67
0x017eaf67
0x017eaf6a
0x017eafca
0x017eafd1
0x00000000
0x017eafd1
0x017eaf6c
0x017eaf6d
0x017eaf75
0x017eaf7c
0x017eaf7e
0x017eaf80
0x017eaf85
0x017eaf87
0x017eaf99
0x017eaf89
0x017eaf92
0x017eaf92
0x017eaf9e
0x017eafa1
0x017eafa3
0x017eafa9
0x017eafb0
0x017eafb2
0x017eafb4
0x017eafbc
0x017eafbc
0x017eafb4
0x017eafb0
0x00000000
0x017eafa1
0x017eaf4f
0x017eaf57
0x017eaf5c
0x017eaf5e
0x00000000
0x00000000
0x017eaf60
0x017eaf64
0x017eaf64
0x00000000
0x017eaf64
0x017eaf1a
0x017eaf25
0x00000000
0x00000000
0x017eaf27
0x017eaf28
0x017eaf33
0x00000000
0x017eaed0
0x017eaed0
0x017eaed2
0x017eaee1
0x017eaee4
0x00000000
0x00000000
0x017eaee6
0x017eaeec
0x00000000
0x00000000
0x017eaefb
0x017eaf07
0x017eafd3
0x017eafdb
0x017eafdb
0x00000000
0x017eaf07
0x017eaed6
0x017eaed8
0x017eaedf
0x00000000
0x00000000
0x00000000
0x017eaedf
0x017eaec9

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28ee50c401bd034318f61154c8a3f0a670b96ea251aa0abf6df3a4e211780a5
Instruction ID: 48de0f1abbe8409caec78fe08f6037d5fdc568b7bc4fbd8b2edcf2302901cc33
Opcode Fuzzy Hash: b28ee50c401bd034318f61154c8a3f0a670b96ea251aa0abf6df3a4e211780a5
Instruction Fuzzy Hash: 9E41C2B17006119BE72ADB2DC89DB3BFBDAAF9C620F044619F916872D4DB34D841C691

Uniqueness

Uniqueness Score: -1.00%

Function 0174DBE9 Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0174DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E0172CC50(E01724510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E01747D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E017F8ED6(_t102, _t98);
						}
						_t76 = _v44;
						E01742280(_t58, _v44);
						E0174DD82(_v44, _t102, _t98);
						E0174B944(_t102, _v5);
						return E0173FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x1818628; // 0x0
							_v28 = _t67;
							_t68 =  *0x181862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x1818628; // 0x0
						_t105 = _v28;
						_t80 =  *0x181862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x17efb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x0174dbe9
0x0174dbf2
0x0174dbf7
0x0174dbf9
0x0174dbfc
0x0174dc00
0x0174dc03
0x0174dc14
0x0174dd54
0x0174dd54
0x0174dd54
0x0174dc18
0x0174dc1d
0x0174dc1d
0x0174dc32
0x0174dc3b
0x0174dc3e
0x0174dc46
0x0174dd5b
0x0174dd62
0x0174dd64
0x0174dd67
0x0174dd69
0x0174dd6b
0x0174dd6e
0x0174dd70
0x0174dd73
0x0174dd73
0x00000000
0x0174dc4c
0x0174dc4e
0x01793ae3
0x01793ae8
0x01793aea
0x0174dce7
0x0174dce9
0x0174dcec
0x0174dcee
0x0174dcf0
0x0174dcf3
0x0174dcf5
0x01793af2
0x01793af5
0x01793af5
0x0174dd06
0x0174dd08
0x0174dd0b
0x0174dd12
0x01793b08
0x0174dd18
0x0174dd18
0x0174dd18
0x0174dd20
0x0174dd23
0x01793b16
0x01793b16
0x0174dd29
0x0174dd2d
0x0174dd36
0x0174dd40
0x0174dd51
0x0174dd51
0x0174dc54
0x0174dc59
0x0174dc59
0x0174dc5e
0x0174dc5e
0x0174dc63
0x0174dc66
0x0174dc6b
0x0174dc78
0x0174dc7b
0x0174dc81
0x0174dc81
0x0174dc83
0x0174dc89
0x00000000
0x00000000
0x0174dd7b
0x0174dd7b
0x0174dc8f
0x0174dc8f
0x0174dc92
0x0174dc99
0x0174dc9f
0x0174dca5
0x0174dcaa
0x0174dcaa
0x0174dcb3
0x0174dcb8
0x0174dcbb
0x0174dcc1
0x0174dccf
0x0174dcd2
0x0174dcd5
0x0174dcd7
0x0174dcda
0x0174dcdc
0x0174dcdc
0x0174dce2
0x0174dce4
0x00000000
0x0174dce4

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8530d11edfd17e04cf9dfed23af5b4207068c9f0d9cc1489b6533b130e9616ac
Instruction ID: 3227ccc3b44550a459c003b456ccef6457a688aef4e1239b7dd7e47f14449599
Opcode Fuzzy Hash: 8530d11edfd17e04cf9dfed23af5b4207068c9f0d9cc1489b6533b130e9616ac
Instruction Fuzzy Hash: B151AE71A00216CFCB25CFA8C490AAEFBF5FF59310F25855AD599A7345DB30AA84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0173EF40 Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0173EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E01729080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x7738c21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E01722D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x0173ef4b
0x0173ef4d
0x0173ef57
0x0173f0bd
0x0173f0c2
0x0173f0d2
0x0173f0d2
0x0173f0c2
0x0173ef5d
0x0173ef5f
0x0173ef67
0x0173ef6a
0x0173ef6d
0x0173ef74
0x0173ef7f
0x0173ef82
0x0173ef82
0x0173ef86
0x0173ef88
0x0173ef8c
0x0173ef8f
0x0173ef8f
0x0173ef8f
0x00000000
0x0173ef91
0x0173ef93
0x0173efc4
0x0173efc4
0x0173efc4
0x0173efca
0x0173efd0
0x0173f0a6
0x00000000
0x00000000
0x0173f0af
0x0178bb06
0x0178bb0a
0x0173f0b5
0x0173f0b5
0x0173f0b5
0x0173f0b5
0x00000000
0x0173efd6
0x0173efd9
0x0173f0de
0x0173f0e2
0x0173efdf
0x0173efdf
0x0173efdf
0x0173efe5
0x0178bafc
0x0178bafc
0x0173efe5
0x0173efeb
0x0173efed
0x0173f00f
0x0173f011
0x0173f01a
0x0173f01d
0x0173f021
0x0173f028
0x0173f029
0x0173f029
0x0173f02c
0x00000000
0x0173f02c
0x0173eff3
0x0173eff9
0x0173f0ea
0x0173f0ed
0x0173f0ef
0x00000000
0x0173f0ef
0x0173f003
0x0178bb12
0x0173f045
0x0173f049
0x0173f051
0x0173f09e
0x0173f0a0
0x0173f0a0
0x0173f09e
0x0173f053
0x0173f064
0x0173f064
0x0173f06b
0x0178bb1a
0x0178bb1a
0x0173f071
0x0173f071
0x0173f07d
0x0173f082
0x0173f08f
0x0173f08f
0x0173f009
0x0173f00d
0x00000000
0x0173f00d
0x0173efd0
0x0173ef97
0x0173efa5
0x0173efaa
0x00000000
0x0173efac
0x0173efac
0x0173efac
0x00000000
0x0173efb2
0x0173f036
0x0173f03a
0x0173f040
0x0173f090
0x00000000
0x0173f092
0x0173f042
0x00000000
0x0173f042
0x0173efb7
0x0173efb9
0x0173efbc
0x0173efb0
0x0173efb0
0x00000000
0x0173efbe
0x0173efbe
0x0173efc1
0x00000000
0x0173efc1
0x0173efbc
0x0173efaa
0x0173ef91

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: b436baf884bfcd9243f937c499c0231a99f929d27b9cbb3f6b9d37fecf7688a9
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 4A512630E0424ADFEB21CB6CC1C07AEFBB1AF85314F1881A8D54553283C7B5A989C752

Uniqueness

Uniqueness Score: -1.00%

Function 017F740D Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E017F740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E0177D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E0176F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L01744620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L01744620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E0176F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L01744620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x017f740d
0x017f740d
0x017f7412
0x017f7413
0x017f7416
0x017f7418
0x017f741c
0x017f741f
0x017f7422
0x017f7422
0x017f7428
0x017f742a
0x017f742a
0x017f7451
0x017f7432
0x017f744f
0x017f744f
0x00000000
0x017f7434
0x017f7438
0x017f7443
0x017f7517
0x017f7517
0x017f751a
0x017f7535
0x017f7520
0x017f7527
0x017f752c
0x017f7531
0x017f7533
0x00000000
0x017f7533
0x00000000
0x017f7531
0x017f754b
0x017f754f
0x017f755c
0x017f755c
0x017f755f
0x017f7560
0x017f7561
0x017f7562
0x017f7563
0x017f7568
0x017f756a
0x017f756c
0x017f756d
0x017f756d
0x017f756f
0x017f7572
0x017f7574
0x017f7577
0x017f757c
0x017f757f
0x00000000
0x017f7551
0x017f7551
0x017f7551
0x017f7553
0x017f7553
0x017f7449
0x017f7449
0x017f744c
0x017f744c
0x00000000
0x017f744c
0x017f7443
0x017f750e
0x017f7514
0x017f7514
0x017f7455
0x017f7469
0x017f746d
0x00000000
0x017f7473
0x017f7473
0x017f7476
0x017f7480
0x017f7484
0x017f748e
0x017f7493
0x017f7493
0x017f7496
0x017f7499
0x017f74a1
0x017f74b1
0x017f74b5
0x00000000
0x017f74bb
0x017f74c1
0x017f74c1
0x017f74c4
0x017f74c5
0x017f74c6
0x017f74c7
0x017f74c8
0x017f74cd
0x00000000
0x017f74d3
0x017f74d3
0x017f74d6
0x017f74d8
0x017f74db
0x017f74dd
0x017f74e0
0x017f74e7
0x017f74ee
0x017f74ee
0x017f74f4
0x017f74f9
0x00000000
0x017f74fb
0x017f74fb
0x017f74fd
0x017f7500
0x017f7503
0x017f7505
0x017f7505
0x017f74f9
0x00000000
0x017f74cd
0x017f74b5
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 129297767601909ebaa5e62503ff657a3d74109a802fecceb74fc1e0d6789193
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 92519071600646EFDB1ACF58D884A96FBB5FF45304F14C0AAEA089F356E371E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01752990 Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E01752990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x17fff00);
				E0177D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x1701664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E0176E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x1701668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E017A51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x170166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E01752AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E01736600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E01752C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E0173EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E01752AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E01752C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E01752ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E0177D0D1(_t62);
				goto L28;
			}

0x01752990
0x01752992
0x01752997
0x017529a3
0x017529a6
0x017529ab
0x017529ad
0x017529b2
0x01795c80
0x017529b8
0x017529b8
0x017529bb
0x017529c0
0x017529c5
0x017529c6
0x017529c6
0x017529cb
0x00000000
0x00000000
0x017529cd
0x017529d0
0x017529d9
0x017529db
0x017529dd
0x01752a7f
0x01752a84
0x01752a87
0x01752a89
0x01795ca1
0x01795ca3
0x00000000
0x01752a8f
0x01752a8f
0x00000000
0x01752a8f
0x00000000
0x017529e3
0x017529e3
0x017529e3
0x00000000
0x017529e3
0x017529dd
0x00000000
0x017529db
0x017529e6
0x017529e9
0x017529eb
0x017529ed
0x017529f3
0x017529f5
0x017529f8
0x017529fa
0x01752a97
0x01752a9a
0x01752a9d
0x01752add
0x00000000
0x01752a9f
0x01752aa2
0x01752aa5
0x01752aa8
0x01752aab
0x01795cab
0x01795caf
0x01795cc5
0x01795cda
0x01795cdc
0x01795cdf
0x01795ce5
0x00000000
0x01795ceb
0x01795ced
0x01795cee
0x00000000
0x01795cee
0x01795cb1
0x01795cb4
0x01795cb9
0x01795cbb
0x00000000
0x01795cbd
0x01795cbd
0x00000000
0x01795cbd
0x01795cbb
0x01752ab1
0x01752ab1
0x01752ac4
0x01752ac6
0x01752ac6
0x00000000
0x01752ac6
0x01752aab
0x00000000
0x01752a00
0x01752a09
0x01752a0e
0x01752a21
0x01752a24
0x01752a35
0x01752a3a
0x01752a3d
0x01752a42
0x01752a59
0x01752a59
0x01752a5c
0x01752a5f
0x01752a5f
0x017529fa
0x017529f3
0x01752a64
0x01752a64
0x01752a6b
0x01752a6b
0x01752a6d
0x01752a72
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87ba969877b3d3427300bc1e53f6f21ca1116ae30deb3f636de4ca437e0972a
Instruction ID: f770eda6a5f7b2b17010312d82edb6088b597b6177fb3ddd7481fbba44b5f99a
Opcode Fuzzy Hash: b87ba969877b3d3427300bc1e53f6f21ca1116ae30deb3f636de4ca437e0972a
Instruction Fuzzy Hash: 61516971A0021AEFDF66DF58C840ADEFBB5BF48310F008159ED01AB222C7759A52CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01754BAD Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E01754BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x181d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E0172CC50(_t86);
					L11:
					return E0176B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x1818504
				E01742280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E0176FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E0176B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L01744620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E0172CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x1818504
								E0173FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E01754F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x01754bad
0x01754bbf
0x01754bc2
0x01754bc6
0x01754bcd
0x01754bd9
0x017967fe
0x01796800
0x01754ccc
0x01754ccd
0x01754cb7
0x01754cc9
0x01754cc9
0x01754bdf
0x01754be5
0x00000000
0x00000000
0x01754beb
0x01754bef
0x00000000
0x00000000
0x01754bf5
0x01754bf9
0x01754c06
0x01754c0b
0x01754c17
0x01754c1c
0x01754c1f
0x01754c25
0x01754c33
0x01754c3d
0x01754c40
0x01754c43
0x01754c47
0x01754c4d
0x01754c53
0x01754c54
0x01754c55
0x01754c56
0x01754c5b
0x01754c5c
0x01754c63
0x01754c6b
0x00000000
0x00000000
0x01796776
0x01796784
0x01796784
0x0179679f
0x017967a7
0x017967af
0x017967ce
0x00000000
0x017967b1
0x017967b7
0x017967b8
0x017967c1
0x017967d3
0x017967d9
0x017967dd
0x01754c94
0x01754c94
0x01754c98
0x01754c9c
0x01754ca3
0x017967f4
0x017967f4
0x01754cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x01754cb5
0x01754c79
0x01754c7e
0x01754c89
0x01754c8b
0x01754c8f
0x01754c8f
0x00000000
0x01754c89
0x017967c3
0x00000000
0x017967c3
0x017967af
0x01754c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfa60a58e477f30dfc10110383f840a62b0ac12be42adea4d76f30f65340890
Instruction ID: a6b0aa3530110fea35d1f83921c75c3965eb0ef1e8635deaab7fca3acce24df6
Opcode Fuzzy Hash: 8cfa60a58e477f30dfc10110383f840a62b0ac12be42adea4d76f30f65340890
Instruction Fuzzy Hash: 3A41C235A002299BDF21DF68D944BEEF7B8EF45710F4101A5E909AB241EB74DE84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01754D3B Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E01754D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x181d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E0176FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x1817bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E0176B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L01744620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0172CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E0176B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E0176F380(_t67 + 0xc, 0x1705138, 0x10) == 0) {
								 *0x18160d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E01754F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E01754E70(0x18186b0, 0x1755690, 0, 0) != 0) {
					_t46 = E0172CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x01754d3b
0x01754d4d
0x01754d53
0x01754d58
0x01754d65
0x01754d6c
0x01754d71
0x01754d77
0x01754d7f
0x01754d8c
0x01754d8e
0x01754dad
0x01754db0
0x01754db7
0x01754db8
0x01754db9
0x01754dba
0x01754dbb
0x01754dc1
0x01754dc8
0x01754dcc
0x01754dd5
0x01754dde
0x01754ddf
0x01754de0
0x01754de1
0x01754de6
0x01754de7
0x01754de9
0x01754df3
0x00000000
0x00000000
0x01796c7c
0x01796c8a
0x01796c8a
0x01796c9d
0x01796ca7
0x01796cac
0x01796cb2
0x01796cb9
0x00000000
0x01796cbf
0x01796cbf
0x00000000
0x01796cbf
0x01796cb9
0x01754dfb
0x01796ccf
0x01796cd3
0x01754e32
0x01754e39
0x01796ce0
0x01796cf2
0x01796cf2
0x01796ce0
0x01754e3f
0x01754e41
0x01754e51
0x01754e51
0x01754e03
0x01754e03
0x01754e09
0x01754e0f
0x01754e57
0x00000000
0x00000000
0x01754e1b
0x01754e30
0x01754e5b
0x01754e5b
0x00000000
0x01754e30
0x01754e11
0x01754e11
0x01754e16
0x00000000
0x01754e16
0x01754e01
0x00000000
0x01754e01
0x01754da5
0x01796c6b
0x00000000
0x01754dab
0x01754dab
0x00000000
0x01754dab

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f2ba18561799aa3c5038bf714e7e3f7cc65476b5ceb627acabf88fd0abf1f6
Instruction ID: 3a4313d7b8a285ec71475e7135b7d66a467dd203fdde10a08131452752c98b91
Opcode Fuzzy Hash: 58f2ba18561799aa3c5038bf714e7e3f7cc65476b5ceb627acabf88fd0abf1f6
Instruction Fuzzy Hash: AA41C371A403189FEB62DF18DC84F6AF7A9EB55610F000099ED4697285E7B0EE84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017EAA16 Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017EAA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E017EABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E017EAB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E017EAC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E017CCB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L017477F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E01747D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E017E131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E017CCB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}

0x017eaa1f
0x017eaa21
0x017eaa23
0x017eaa2b
0x017eaa30
0x017eaa36
0x017eaa39
0x017eaa42
0x017eaa75
0x017eaa7a
0x017eaa7c
0x017eaa7c
0x017eaa88
0x017eaa8a
0x017eaa8f
0x017eab02
0x017eab04
0x017eaa99
0x017eaaa8
0x017eaaaf
0x017eaab3
0x017eaacc
0x017eaad1
0x017eaad6
0x017eaae0
0x017eaaf3
0x017eaaf9
0x017eaafe
0x017eaafe
0x017eaaf3
0x017eaad6
0x017eaab3
0x017eab07
0x017eab0a
0x017eab11
0x017eab23
0x017eab13
0x017eab1c
0x017eab1c
0x017eab2b
0x017eab44
0x017eab44
0x017eab51
0x017eab51
0x017eaa44
0x017eaa47
0x017eaa4c
0x00000000
0x00000000
0x017eaa5a
0x017eaa64
0x017eaa72
0x00000000
0x017eaa66
0x017eaa66
0x017eaa68
0x017eaa6a
0x00000000
0x017eaa6a

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: 299c4478eaaf71df82405093582cd91c99da328c6c778eb608283175c94f06bf
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: 9E31E432F00245ABEF159B69CC8DFAFFBFBEF88610F054469E905A7291DA749D40C650

Uniqueness

Uniqueness Score: -1.00%

Function 01738A0A Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01738A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x181d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E0176B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E0173E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x1701180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E01751DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E01763C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E01738999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x01738a0a
0x01738a1c
0x01738a23
0x01738a2e
0x01738a30
0x01738a36
0x01738a3c
0x01738a3e
0x01738a4a
0x01738a52
0x01738a9c
0x01738aae
0x01738a58
0x01738a5e
0x01738a6a
0x01738a6f
0x01738a75
0x01738a7d
0x01738a85
0x01738a86
0x01738a89
0x01738a93
0x01738a99
0x01738a9b
0x00000000
0x01738aaf
0x01738abe
0x01738ac3
0x01738acb
0x01738ad7
0x01738ae0
0x01738af1
0x00000000
0x01738af1
0x01738acd
0x01738ad5
0x01738afb
0x01738afd
0x01738aff
0x01738b07
0x01738b22
0x01738b24
0x01738b2a
0x01738b2e
0x01738b3f
0x01738b78
0x01738b41
0x01738b52
0x01738b54
0x01738b5c
0x01738b74
0x01738b74
0x01738b5c
0x01738b3f
0x01738b5e
0x01738b61
0x01738b64
0x01738b64
0x01738b6c
0x01738b6c
0x01738b11
0x01789cd5
0x01789cd5
0x01738b17
0x01738b1a
0x01738b1a
0x00000000
0x01738ad5
0x01738a89

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f265f9721d2a412ab52eae2b070e9252496099a053c01e443b628e53579c92
Instruction ID: a4b9de2b0646c327f5b5ed8da00d8ab3118f2a769a52a791577adb68e8e9c57e
Opcode Fuzzy Hash: 36f265f9721d2a412ab52eae2b070e9252496099a053c01e443b628e53579c92
Instruction Fuzzy Hash: A14152B1A4022D9BDB24DF59CC88AA9F7F8EB94300F1046E9E91997243E7709E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 017EFDE2 Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E017EFDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E017EFD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E017F0A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E01747D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E017E1608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E017F2B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E017EC8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E017EDBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E01747D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E017EA80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x017efde7
0x017efde8
0x017efdec
0x017efdee
0x017efdf5
0x017efdf7
0x017efdfc
0x017efe19
0x017efe22
0x017efe26
0x017efec6
0x017efecd
0x017efed5
0x017efee7
0x017efed7
0x017efee0
0x017efee0
0x017efeef
0x017eff00
0x017eff02
0x017eff07
0x017eff07
0x00000000
0x017efeef
0x017efe33
0x017efe55
0x017efe59
0x017efe5b
0x017efe5e
0x017efe69
0x017efe6d
0x017efe6d
0x017efe69
0x017efe35
0x017efe41
0x017efe41
0x017efe79
0x017efe8b
0x017efe7b
0x017efe84
0x017efe84
0x017efe93
0x00000000
0x017efea8
0x017efeba
0x00000000
0x017efeba
0x017efdfe
0x017efe01
0x017efe02
0x017efe08
0x017eff0c
0x017eff14
0x017eff14

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 42ba42af65fcf85a8939c8366a22ea1a6324483b7f80fe1f127b3123a408d2d6
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 8431F4322006416FD7229B6CC84DF6AFBEAEBCD650F184598E9468BB46DB74EC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 017EEA55 Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E017EEA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E01742280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E017EE815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E0172F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E0173FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E017EAFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E017EBCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E01747D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E017DFE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E0173FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E017EA80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x017eea55
0x017eea66
0x017eea68
0x017eea6c
0x017eea6f
0x017eea72
0x017eea75
0x017eea7a
0x017eea7a
0x017eea7e
0x017eea80
0x017eea85
0x017eea8b
0x017eeab5
0x017eeabc
0x017eeabf
0x017eeabf
0x017eeaca
0x017eeace
0x017eead0
0x017eeae4
0x017eeaeb
0x017eeaf0
0x017eeaf5
0x017eeb09
0x017eeb0d
0x017eeb1d
0x017eeb2d
0x017eeb38
0x017eeb3d
0x017eeb41
0x017eeb4a
0x017eeb60
0x017eeb4c
0x017eeb52
0x017eeb59
0x017eeb59
0x017eeb68
0x017eeb71
0x017eeb71
0x017eea8d
0x017eea8f
0x017eea92
0x017eea97
0x017eea97
0x017eea9b
0x017eea9c
0x017eea9e
0x017eeaa6
0x017eeaa6
0x017eeb7e

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: c92d44f2564ff1452ccf203c3ca5adbd54c85bbd19ca846858c6d2a28e040537
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 6331A1726047069BC719DF28C888A6BF7E9FBC8650F044A2DF59687645DE30E905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017A69A6 Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E017A69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x181d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L01736C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E017A6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E01769980() >= 0) {
							E01742280(_t56, 0x1818778);
							_t77 = 1;
							_t68 = 1;
							if( *0x1818774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x1818774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E0172B6F0(0x170c338, 0x170c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E01769520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E017695D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E0173FFB0(_t68, _t77, 0x1818778);
				}
				_pop(_t78);
				return E0176B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x017a69b5
0x017a69be
0x017a69c3
0x017a69c9
0x017a69cc
0x017a69d1
0x017a69d3
0x017a69de
0x017a69e1
0x017a69ea
0x017a69f6
0x017a69fe
0x017a6a13
0x017a6a14
0x017a6a15
0x017a6a16
0x017a6a1e
0x017a6a26
0x017a6a31
0x017a6a36
0x017a6a37
0x017a6a40
0x017a6a49
0x017a6a4a
0x017a6a53
0x017a6a59
0x017a6a5d
0x017a6a5e
0x017a6a64
0x017a6a67
0x017a6a6a
0x017a6a6d
0x017a6a70
0x017a6a77
0x017a6a7d
0x017a6a86
0x017a6a89
0x017a6a9c
0x017a6a9f
0x017a6aa2
0x017a6aa5
0x017a6aaf
0x017a6ab1
0x017a6ab8
0x017a6ab9
0x017a6abb
0x017a6abe
0x017a6ac5
0x017a6ac5
0x017a6aaf
0x017a6a40
0x017a6a26
0x017a69fe
0x017a6ace
0x017a6ad0
0x017a6ad3
0x017a6ad8
0x017a6adf
0x017a6adf
0x017a6ae8
0x017a6aef
0x017a6aef
0x017a6af9
0x017a6b06

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcec08d4b8d6ccb4ded718dccf24884d0c1eeccf93a17a7c4fc88aa3ad9f1528
Instruction ID: e6f09fa70b699b9fbd3ef285656eda833e0f4c7a294285a45c6be8398acdd7bb
Opcode Fuzzy Hash: dcec08d4b8d6ccb4ded718dccf24884d0c1eeccf93a17a7c4fc88aa3ad9f1528
Instruction Fuzzy Hash: BF417EB1D012099FDB11CFA9D944BEEFBF8EF88714F18862AE914A3244DB709A05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01725210 Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E01725210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E017252A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E017695D0();
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E0173EB70(_t54, 0x18179a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E017695D0();
								L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E0173EB70(_t54, 0x18179a0);
						}
						return _t52;
					}
					L5:
					_t33 = E0176F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E0173EB70(_t54, 0x18179a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E017695D0();
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x01725220
0x01725224
0x01780d13
0x01780d16
0x01780d19
0x0172522a
0x0172522a
0x0172522d
0x0172522d
0x01725231
0x01725235
0x01725239
0x01780d5c
0x01780d62
0x00000000
0x00000000
0x01780d6a
0x01780d7b
0x01780d7f
0x01780d81
0x01780d84
0x01780d95
0x01780d95
0x01780d6c
0x01780d71
0x01780d71
0x01780d9a
0x00000000
0x0172524a
0x0172524a
0x01725250
0x01780d24
0x01780d35
0x01780d39
0x01780d3b
0x01780d3e
0x01780d50
0x01780d50
0x01780d26
0x01780d2b
0x01780d2b
0x00000000
0x01780d55
0x01725256
0x0172525b
0x01725265
0x01780da7
0x0172526b
0x0172526e
0x01725272
0x01780db1
0x01780db4
0x01780dc5
0x01780dc5
0x01725272
0x01725278
0x0172527e
0x0172528a
0x0172528c
0x0172528d
0x00000000
0x01725280
0x01725282
0x01725288
0x0172529f
0x01725292
0x00000000
0x01725292
0x00000000
0x01725288
0x0172527e

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60261af23100637b8daff0a73970f45d963110f3721ee8eb6bfbfda641bb1c6
Instruction ID: 96997877e063b5662330e01d2af4a9d7ea7b8a4145556d9072df6f05d2b5836b
Opcode Fuzzy Hash: d60261af23100637b8daff0a73970f45d963110f3721ee8eb6bfbfda641bb1c6
Instruction Fuzzy Hash: 15312831285611EBC726AF18C884F6AF7A9FF10720F11462AF9154B2D5DB30E945C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 01763D43 Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01763D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E01737B60(0, _t61, 0x17011c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E01737B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L01744620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x01763d4c
0x01763d50
0x01763d55
0x01763d5e
0x0179e79a
0x00000000
0x0179e79a
0x01763d68
0x0179e789
0x01763d9d
0x01763da3
0x01763daf
0x01763db5
0x01763dbc
0x01763dc4
0x01763dc9
0x01763dce
0x0179e7ae
0x0179e7ae
0x01763dde
0x01763de2
0x01763de7
0x01763e0d
0x01763e13
0x01763e16
0x01763e1e
0x01763e25
0x01763e28
0x00000000
0x00000000
0x01763e2a
0x01763e2f
0x01763e37
0x01763e37
0x00000000
0x01763e37
0x01763e31
0x00000000
0x01763e31
0x01763e20
0x01763e20
0x01763e35
0x00000000
0x01763de9
0x01763de9
0x01763de9
0x01763dee
0x01763dfd
0x01763dff
0x01763e02
0x01763e05
0x01763e05
0x00000000
0x01763df0
0x01763de7
0x0179e78f
0x0179e794
0x01763d79
0x01763d84
0x01763d89
0x01763d8e
0x00000000
0x0179e7a4
0x01763d96
0x01763d9a
0x00000000
0x01763d9a
0x00000000
0x0179e794
0x01763d6e
0x01763d73
0x00000000
0x0179e7b5
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0447cf5da1b02b208a19dab5988b1fe9b8ab0dafeddb6d5cc6bc7b2c2679c9
Instruction ID: b5d03e058496b382b4e24b145693170afac28a5d0a07b7574fb5033b4da6ef60
Opcode Fuzzy Hash: 4e0447cf5da1b02b208a19dab5988b1fe9b8ab0dafeddb6d5cc6bc7b2c2679c9
Instruction Fuzzy Hash: B731B031600615DBDB29CF2DD841A6AFBF9FF5970070980AEE949CB351EB30D880C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0175A61C Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0175A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x1800220);
				E0177D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x1817b9c; // 0x0
				_t55 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E0177D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x1817b10 =  *0x1817b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x181536c; // 0x77495368
					if( *_t51 != 0x1815368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x1815368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x181536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E0175A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x0175a61c
0x0175a61e
0x0175a623
0x0175a628
0x0175a62b
0x0175a62d
0x0175a648
0x0175a64a
0x0175a64f
0x01799b44
0x0175a6ec
0x0175a6f1
0x0175a6f1
0x0175a655
0x0175a657
0x0175a65a
0x0175a65d
0x0175a662
0x0175a663
0x0175a667
0x0175a668
0x0175a66d
0x0175a706
0x0175a706
0x01799bda
0x01799be6
0x01799beb
0x00000000
0x01799beb
0x0175a679
0x01799b7a
0x00000000
0x01799b7a
0x0175a683
0x0175a6f4
0x0175a6f7
0x0175a6f9
0x0175a6fd
0x0175a6a0
0x0175a6a0
0x0175a6ad
0x0175a6af
0x0175a6b4
0x01799ba7
0x01799bac
0x00000000
0x00000000
0x01799bc6
0x01799bce
0x01799bd1
0x01799bd3
0x01799bd3
0x00000000
0x01799bd1
0x0175a6bd
0x0175a6c3
0x0175a6c6
0x0175a6d2
0x0175a701
0x0175a704
0x00000000
0x0175a704
0x0175a6d4
0x0175a6d6
0x0175a6d9
0x0175a6db
0x0175a6e1
0x0175a6e6
0x0175a6e8
0x0175a6e8
0x0175a6ea
0x00000000
0x0175a6ea
0x0175a688
0x0175a692
0x0175a694
0x0175a699
0x00000000
0x00000000
0x0175a69d
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4559b502bc3e0ef03791fa464f450ec35434fd251c75fd20f416b1ac630b6bc4
Instruction ID: c092e117fc79a2141809f8de4edc1b79fc090a7aaf4890aa2f3be806f74dd8e9
Opcode Fuzzy Hash: 4559b502bc3e0ef03791fa464f450ec35434fd251c75fd20f416b1ac630b6bc4
Instruction Fuzzy Hash: 204158B5A00205DFDB55CF58D890B99FBF5FB89304F1581ADEA05AB344C7B8AA01CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0174C182 Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0174C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E01747D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E017F8D34(_v8, _t80);
					}
					E01742280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0173FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E017F8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0173FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E0176B180();
						if(_a4 != 0) {
							E01742280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0174BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0174BB2D(_t16, _t15);
						E0174B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0173FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0173FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0173FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0174c18d
0x0174c18f
0x0174c191
0x0174c19b
0x0174c1a0
0x0174c1d4
0x0174c1de
0x01792d6e
0x0174c1e4
0x0174c1e4
0x0174c1e4
0x0174c1ec
0x01792d7d
0x01792d7d
0x0174c1f3
0x0174c1ff
0x01792d88
0x01792d8d
0x01792d94
0x01792d94
0x01792d9f
0x01792da4
0x01792dab
0x01792db0
0x01792db2
0x01792db3
0x01792db4
0x01792dbc
0x01792dc3
0x01792dc3
0x0174c205
0x0174c205
0x0174c208
0x0174c20e
0x0174c211
0x0174c216
0x0174c219
0x0174c21f
0x0174c222
0x0174c22c
0x0174c234
0x0174c23a
0x0174c23f
0x0174c245
0x0174c24b
0x0174c251
0x0174c25a
0x0174c276
0x0174c27d
0x0174c27d
0x0174c25c
0x0174c25c
0x00000000
0x0174c25e
0x0174c1a4
0x0174c1aa
0x0174c1b3
0x0174c265
0x0174c26c
0x0174c26c
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: e49abaaca84583822fe6626d0aa85487633ab8de70bd74d8885591f4b141c711
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: FD3178B2B06587BFDB06EBB4C484BE9FB54BF52200F04415AD51C87306DB34AA49DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 017A7016 Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E017A7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x181d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E017A6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E017A6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E01747D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E01769AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E0176B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L01744620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x017a7016
0x017a701e
0x017a702b
0x017a7033
0x017a7037
0x017a703c
0x017a703e
0x017a7041
0x017a7045
0x017a704a
0x017a7050
0x017a7055
0x017a705a
0x017a7062
0x017a7062
0x017a705a
0x017a7064
0x017a7064
0x017a7067
0x017a7071
0x017a7096
0x017a709b
0x017a70a2
0x017a70a6
0x017a70a7
0x017a70ad
0x017a70b3
0x017a70b6
0x017a70bb
0x017a70c3
0x017a70c3
0x017a70c6
0x017a70cd
0x017a70dd
0x017a70e0
0x017a70e2
0x017a70e2
0x017a70ee
0x017a7101
0x017a70f0
0x017a70f9
0x017a70f9
0x017a710a
0x017a710e
0x017a7112
0x017a7117
0x017a7118
0x017a7118
0x017a70bb
0x017a711d
0x017a7123
0x017a7131
0x017a7131
0x017a7136
0x017a713d
0x017a713e
0x017a713f
0x017a714a
0x017a714a
0x017a7084
0x017a7088
0x00000000
0x017a708e
0x017a708e
0x017a7092
0x00000000
0x017a7092

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b719c020cfee1818b570cbdc9dc178f16c313a8490e8cb3150ffa0c9792bea
Instruction ID: 6968af2f69109025f6f825f3a5273027241149ff5d9ffb78431d4da4cfc0b717
Opcode Fuzzy Hash: 78b719c020cfee1818b570cbdc9dc178f16c313a8490e8cb3150ffa0c9792bea
Instruction Fuzzy Hash: 9731BF726047919BC324DF28C844A6BF7E9BFC8700F444A29F99587694E731E904CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0175A70E Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0175A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x1817b10; // 0x0
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x1817b10 = 8;
					 *0x1817b14 = 0x1817b0c;
					 *0x1817b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x1
					E0175A990(0x1817b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L0175A840(__edx, __ecx, __ecx, _t52, 0x1817b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x1817b10; // 0x0
					_t3 = _t37 + 0x27; // 0x27
					__eflags = _t3 >> 5 -  *0x1817b18; // 0x0
					if(__eflags > 0) {
						_t38 =  *0x1817b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x27
						_v8 = _t4 >> 5;
						_t50 = L01744620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x1817b18 = _v8;
						_t8 = _t52 + 7; // 0x7
						E0176F3E0(_t50,  *0x1817b14, _t8 >> 3);
						_t28 =  *0x1817b14; // 0x0
						__eflags = _t28 - 0x1817b0c;
						if(_t28 != 0x1817b0c) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x8
						 *0x1817b14 = _t50;
						_t48 = _v12;
						 *0x1817b10 = _t9;
						goto L6;
					}
					 *0x1817b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x0175a713
0x0175a714
0x0175a717
0x0175a71d
0x0175a720
0x0175a722
0x0175a727
0x0175a74a
0x0175a754
0x0175a75e
0x0175a768
0x0175a76a
0x0175a773
0x0175a78b
0x0175a790
0x0175a792
0x0175a741
0x0175a741
0x0175a743
0x0175a749
0x0175a749
0x0175a732
0x0175a73a
0x0175a797
0x0175a79d
0x0175a7a3
0x0175a7a9
0x0175a7b6
0x0175a7bc
0x0175a7ca
0x0175a7e0
0x0175a7e2
0x0175a7e4
0x01799bf2
0x00000000
0x01799bf2
0x0175a7ed
0x0175a7f2
0x0175a800
0x0175a805
0x0175a80d
0x0175a812
0x01799c08
0x01799c08
0x0175a818
0x0175a81b
0x0175a821
0x0175a824
0x00000000
0x0175a824
0x0175a7ae
0x00000000
0x0175a7ae
0x0175a73c
0x0175a73e
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4599389cfb38d680a8cef49eaf8e3d0e67c4cc8b48aa0f9ae803859c6533e1dc
Instruction ID: f3c57110bae57480649079b83c8fc6b2fc6984ff76f8bf5225531b7bbf8dffe8
Opcode Fuzzy Hash: 4599389cfb38d680a8cef49eaf8e3d0e67c4cc8b48aa0f9ae803859c6533e1dc
Instruction Fuzzy Hash: C231AFB27002059FD721CF18E880F69BBFDFB94710F144AAEE606D7248D7B5AA01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 017561A0 Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E017561A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E01755E50(0x17067cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E017F9D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E0172F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x017561b3
0x017561b5
0x017561bd
0x017561c3
0x017561c7
0x017561d2
0x017561ff
0x017561ff
0x01756201
0x01756207
0x01756207
0x017561d4
0x017561d9
0x00000000
0x00000000
0x017561df
0x017561e2
0x00000000
0x00000000
0x017561e6
0x017561e8
0x017561ee
0x017561ee
0x017561f9
0x0179762f
0x01797632
0x01797635
0x01797639
0x01797640
0x0179766e
0x01797675
0x00000000
0x00000000
0x01797681
0x01797689
0x0179768d
0x01797691
0x01797695
0x01797699
0x017976af
0x017976b5
0x017976b7
0x017976b7
0x017976d7
0x017976dc
0x00000000
0x017976dc
0x017976a2
0x017976a9
0x01797651
0x01797653
0x01797653
0x01797656
0x01797656
0x00000000
0x01797656
0x01797644
0x01797646
0x01797648
0x01797648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ef44640cbc1ec26960e0c5832df524206549f4397a46dd8e27b5ae3d44a8bf
Instruction ID: b30e37d06d1f3b6cae89df6f7879af517a19e463b5d469831c7a2af4ac2f94f0
Opcode Fuzzy Hash: 41ef44640cbc1ec26960e0c5832df524206549f4397a46dd8e27b5ae3d44a8bf
Instruction Fuzzy Hash: 2C3159716197018FE764CF1DC840B26FBE4BB88B10F45496DFA989B351E7B0E804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0172AA16 Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0172AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x181d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x1817b9c; // 0x0
					_t53 = L01744620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E0176B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E0176F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L01736C59(_t53, _t51, _t58) != 0) {
							_t28 = E01755E50(0x170c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E0175B230(_v32, _v28, 0x170c2d8, 1,  &_v24);
								_t28 = E0172F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x0172aa25
0x0172aa29
0x0172aa2d
0x0172aa30
0x0172aa37
0x0172aa3c
0x01784458
0x01784458
0x01784472
0x01784474
0x01784476
0x0172aa64
0x0172aa74
0x0178447c
0x01784483
0x01784492
0x0172aa52
0x0172aa54
0x0172aa5e
0x017844a8
0x017844ad
0x017844af
0x017844b6
0x017844b6
0x017844b9
0x017844bc
0x017844cd
0x017844d3
0x017844d6
0x017844e1
0x017844e1
0x017844e6
0x017844e8
0x017844fb
0x017844fb
0x017844e8
0x00000000
0x0172aa5e
0x01784476
0x0172aa42
0x0172aa46
0x0172aa48
0x0172aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262a95f6951970ad6a1b2a2ee08848fab84e33c7c0fb8b95c2b994f23ba03fce
Instruction ID: 1e2be5f3181bb31171257b8764bae059bf2d8b1fcfd84cc2a2b2072d05cd6f4a
Opcode Fuzzy Hash: 262a95f6951970ad6a1b2a2ee08848fab84e33c7c0fb8b95c2b994f23ba03fce
Instruction Fuzzy Hash: 8231C3B2A0022AABCF11AF69CD41A7FF7B9FF14700B014469F905E7254E774AA11DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01768EC7 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E01768EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x181d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E01754E70(0x18186e4, 0x1769490, 0, 0);
					if( *0x18153e8 > 5 && E01768F33(0x18153e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x18153e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x18153e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x170bc46;
						_t48 = E017A7B9C(0x18153e8, 0x170bc46, _t67, 0x18153e8, _t70,  &_v140);
					}
				}
				return E0176B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x01768ec7
0x01768ed9
0x01768edc
0x01768ee6
0x01768ee9
0x01768eee
0x01768efc
0x01768f08
0x017a1349
0x017a1353
0x017a135d
0x017a1366
0x017a136f
0x017a1375
0x017a137c
0x017a1385
0x017a1390
0x017a1391
0x017a139c
0x017a139d
0x017a13a6
0x017a13ac
0x017a13b2
0x017a13b5
0x017a13bc
0x017a13bf
0x017a13c2
0x017a13c5
0x017a13c8
0x017a13cb
0x017a13ce
0x017a13d1
0x017a13d4
0x017a13d7
0x017a13da
0x017a13dd
0x017a13e0
0x017a13e3
0x017a13e6
0x017a13e9
0x017a13f6
0x017a1400
0x017a1400
0x01768f08
0x01768f32

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3fde5fe37ad3fa2699e558c4ecaa8303a2b5dbcff049824b9e8053c590320f
Instruction ID: 7595a07d43a991af8b4996f690be8e088df12dbeb442e750c251aa50843465e7
Opcode Fuzzy Hash: 7a3fde5fe37ad3fa2699e558c4ecaa8303a2b5dbcff049824b9e8053c590320f
Instruction Fuzzy Hash: 8441AFB1D003189FDB20CFAAD981AAEFBF8FB49310F5041AEE509A7244E7705A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0175E730 Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0175E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E01769670() < 0) {
					E0177DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x1817b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L01744620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0175E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0175e730
0x0175e736
0x0175e738
0x0175e73d
0x0175e73e
0x0175e740
0x0175e749
0x0175e765
0x0175e76a
0x0175e76b
0x0175e76c
0x0175e76d
0x0175e76e
0x0175e76f
0x0175e775
0x0175e777
0x0175e77e
0x0179b675
0x0175e784
0x0175e784
0x0175e789
0x0175e7a8
0x0175e7ac
0x0175e807
0x0175e7ae
0x0175e7ae
0x0175e7b1
0x0175e7b4
0x0175e7b9
0x0175e7c0
0x0175e7c4
0x0175e7ca
0x0175e7cc
0x00000000
0x0175e7d3
0x0175e7d6
0x00000000
0x00000000
0x0175e7ff
0x0175e802
0x00000000
0x00000000
0x0175e7f9
0x0175e7fc
0x00000000
0x00000000
0x0175e7f3
0x0175e7f6
0x00000000
0x00000000
0x0175e7ed
0x0175e7f0
0x00000000
0x00000000
0x0175e7e7
0x0175e7ea
0x00000000
0x00000000
0x0179b685
0x0179b688
0x00000000
0x00000000
0x0179b682
0x00000000
0x00000000
0x0175e7cc
0x0175e7d9
0x0175e7dc
0x0175e7de
0x0175e7de
0x0175e7ac
0x0175e7e4
0x0175e74b
0x0175e751
0x0175e759
0x0175e761
0x0175e761

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe40f39de383dd65d1d88de2254600ccfa0cc4955d7a22541d7f146b0c91f3d
Instruction ID: c73b378e91f2ea15c84ad7eac041ca0cc767aeebadb11fd252b358de29c9bace
Opcode Fuzzy Hash: efe40f39de383dd65d1d88de2254600ccfa0cc4955d7a22541d7f146b0c91f3d
Instruction Fuzzy Hash: 4A315C75A14249AFD744CF68D845B9AFBE8FB09314F14869AFA04CB341DA71ED80CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0175BC2C Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0175BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x1816100; // 0x5
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E01742280(0xd, 0x786f1a0);
				_t41 =  *0x18160f8; // 0x0
				if(_t41 != 0) {
					 *0x18160f8 =  *_t41;
					 *0x18160fc =  *0x18160fc + 0xffff;
				}
				E0173FFB0(_t41, 0x800, 0x786f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x18160f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L01744620(0x1816100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x1816100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0175bc36
0x0175bc42
0x0175bc45
0x0175bc4a
0x0175bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0175bc50
0x0175bc50
0x0175bc58
0x0175bc5a
0x0175bc60
0x00000000
0x00000000
0x0179a4f2
0x0179a4f6
0x00000000
0x00000000
0x00000000
0x0179a4fc
0x0175bc79
0x0175bc7e
0x0175bc86
0x0175bd16
0x0175bd20
0x0175bd20
0x0175bc8d
0x0175bc94
0x0175bcbd
0x0175bcca
0x0175bccb
0x0175bccc
0x0175bccd
0x0175bcce
0x0175bcd4
0x0175bcea
0x0175bcee
0x0175bcf2
0x0175bd00
0x0175bd04
0x00000000
0x0175bc96
0x0175bcab
0x0175bcaf
0x0175bd2c
0x0175bd2c
0x0175bd09
0x00000000
0x0175bd09
0x0175bcb1
0x0175bcb5
0x0175bcbb
0x00000000
0x00000000
0x00000000
0x0175bcbb

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2826e49ba96ce962f5de271fdafd6f59e409af55c97d97792cbd979dbb35e066
Instruction ID: ef8c96463c10ddf00af04fbcab652525e249f568b1848a8d0886edc722d88090
Opcode Fuzzy Hash: 2826e49ba96ce962f5de271fdafd6f59e409af55c97d97792cbd979dbb35e066
Instruction Fuzzy Hash: 1A31F232A006169BCB51DF58D4807B6B7B9FF18311F1500B9ED84EB20AFBB5DA49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01729100 Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E01729100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x17ff6e8);
				E0177D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E017F88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E0177D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x18186c0; // 0x11207b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x18186b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E01742280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E017F88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E0176AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x181b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x18184c0;
										if(_t69 >=  *0x18184c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E017F9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0172922A(_t82);
							_t53 = E01747D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E017F8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x18186c0; // 0x11207b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x18186b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x18186bc;
										_t72 = 0x18186b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E01729240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x18186c4;
									_t72 = 0x18186c0;
									L18:
									E01759B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x01729100
0x01729100
0x01729100
0x01729100
0x01729102
0x01729107
0x0172910c
0x01729110
0x01729115
0x01729136
0x01729143
0x017837e4
0x017837e4
0x01729149
0x0172914e
0x0172914e
0x01729117
0x0172911d
0x00000000
0x00000000
0x0172911f
0x01729125
0x00000000
0x01729151
0x01729158
0x0172915d
0x01729161
0x01729168
0x01783715
0x00000000
0x0172916e
0x0172916e
0x01729175
0x01729177
0x0172917e
0x0172917f
0x01729182
0x01729182
0x01729187
0x01729187
0x0172918a
0x0172918d
0x0172918f
0x01729192
0x01729195
0x01729198
0x01729198
0x01729198
0x0172919a
0x00000000
0x00000000
0x0178371f
0x01783721
0x01783727
0x0178372f
0x01783733
0x01783735
0x01783738
0x0178373b
0x0178373d
0x01783740
0x00000000
0x00000000
0x01783746
0x01783749
0x00000000
0x00000000
0x0178374f
0x01783751
0x00000000
0x00000000
0x01783757
0x01783759
0x0178375c
0x0178375c
0x0178375e
0x0178375e
0x01783761
0x01783764
0x00000000
0x00000000
0x01783766
0x01783768
0x017837a3
0x017837a3
0x017837a5
0x017837a7
0x017837ad
0x017837b0
0x017837b2
0x017837bc
0x017837c2
0x017837c2
0x017837b2
0x01729187
0x01729187
0x0172918a
0x0172918d
0x0172918f
0x01729192
0x01729195
0x00000000
0x01729195
0x00000000
0x01729187
0x0178376a
0x0178376a
0x0178376c
0x0178376c
0x0178376f
0x01783775
0x00000000
0x00000000
0x01783777
0x01783779
0x00000000
0x00000000
0x01783782
0x01783787
0x01783789
0x01783790
0x01783790
0x0178378b
0x0178378b
0x0178378b
0x01783792
0x01783795
0x01783795
0x01783798
0x01783798
0x0178379b
0x0178379b
0x017291a3
0x017291a9
0x017291b0
0x017291b4
0x017291b4
0x017291bb
0x017291c0
0x017291c5
0x017291c7
0x017837da
0x017291cd
0x017291cd
0x017291cd
0x017291d2
0x017291d5
0x01729239
0x01729239
0x017291d7
0x017291db
0x017291e1
0x017291e7
0x017291fd
0x01729203
0x0172921e
0x01729223
0x00000000
0x01729223
0x01729205
0x01729208
0x0172920c
0x01729214
0x01729214
0x017291e9
0x017291e9
0x017291ee
0x017291f3
0x017291f3
0x017291f3
0x017291e7
0x00000000
0x017291db
0x01729187
0x01729168

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7773403be8bceaef5f594f0ee73e0a6fa50854e75d95bc018e69291987b0b369
Instruction ID: 196074d070416d58709f687636b611383bf0d599c4088f49b000563d6605e3f9
Opcode Fuzzy Hash: 7773403be8bceaef5f594f0ee73e0a6fa50854e75d95bc018e69291987b0b369
Instruction Fuzzy Hash: 0731CF71A002A5DFEB26EB6DC48CBADFBF1BB59318F2C814DC60467245C330A981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01751DB5 Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E01751DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0174F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L01744620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0174F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x01751dc2
0x01751dc5
0x01751dc7
0x01751dcc
0x01751dce
0x01751dd6
0x01751ddf
0x01751de0
0x01751de1
0x01751de5
0x01751de8
0x01751def
0x01751df0
0x01751df6
0x01751df7
0x01751dfe
0x01751e1a
0x00000000
0x00000000
0x01751e0b
0x01751e12
0x01751e12
0x01751e00
0x01751e00
0x01751e05
0x01751e1e
0x01751e23
0x0179570f
0x01795713
0x00000000
0x00000000
0x01795719
0x01795719
0x01751e2c
0x01751e2d
0x01751e2e
0x01751e2f
0x01751e31
0x01751e32
0x01751e35
0x01751e3d
0x01795723
0x0179573d
0x0179573d
0x00000000
0x01795723
0x01751e49
0x01751e4e
0x01751e4e
0x01751e09
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 0837d4d4ee086809eb4f5bb6529a0107a190a6a33a0966ffffaf05b907adb054
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 9621AE72600119EFD721CF99CC84FABFBBDEF89642F514095EA0197210D774AE01EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017A6C0A Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E017A6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E01747D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x1817b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L01744620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E0176F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E01747D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E01769AE0();
						_t23 = L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x017a6c0a
0x017a6c0f
0x017a6c10
0x017a6c13
0x017a6c15
0x017a6c19
0x017a6c1c
0x017a6c21
0x017a6c28
0x017a6c3a
0x017a6c2a
0x017a6c33
0x017a6c33
0x017a6c3f
0x017a6c48
0x017a6c4d
0x017a6c60
0x017a6c65
0x017a6c69
0x017a6c73
0x017a6c79
0x017a6c7f
0x017a6c86
0x017a6c90
0x017a6c94
0x017a6ca6
0x017a6cb2
0x017a6cbd
0x017a6cbd
0x017a6cc3
0x017a6cc7
0x017a6ccb
0x017a6cd0
0x017a6cd1
0x017a6ce2
0x017a6ce2
0x017a6c69
0x017a6ced

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252eab9292b3cbc6a67791eb74707032506d8122889c8ea98289710c8aa0f675
Instruction ID: ff07089963d311e3378532d179d0a0ca1b9f8259fb891b4417bed0406659c5d1
Opcode Fuzzy Hash: 252eab9292b3cbc6a67791eb74707032506d8122889c8ea98289710c8aa0f675
Instruction Fuzzy Hash: F2219AB2A00645AFD715DF68D884F2AF7A8FF48700F080169F904C7790D734E950CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 017690AF Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E017690AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E0177D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0175E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L01744620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E0176F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0175A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x017690af
0x017690b8
0x017690bb
0x017690bf
0x017690c2
0x017690c2
0x017690c8
0x017690cb
0x017690cd
0x017a14d7
0x017a14eb
0x017a14eb
0x00000000
0x017a14eb
0x017a14db
0x017a14e6
0x00000000
0x017a14f2
0x017a14e8
0x00000000
0x017a14e8
0x017690d8
0x017690da
0x017690dd
0x017690e5
0x00000000
0x01769139
0x017690fa
0x017690fe
0x01769142
0x00000000
0x01769142
0x01769104
0x01769107
0x0176910b
0x01769110
0x01769118
0x01769147
0x01769148
0x0176914f
0x01769150
0x01769151
0x01769152
0x01769156
0x0176915d
0x01769160
0x01769168
0x0176916c
0x017691bc
0x017691be
0x00000000
0x017691be
0x0176916e
0x01769173
0x01769176
0x00000000
0x00000000
0x0176917c
0x01769180
0x017691b5
0x00000000
0x017691b5
0x01769182
0x01769185
0x01769189
0x00000000
0x00000000
0x0176918e
0x01769190
0x01769198
0x00000000
0x00000000
0x017691a0
0x00000000
0x017691ad
0x017691ad
0x017691b0
0x017691b1
0x00000000
0x01769185
0x0176911a
0x0176911c
0x0176911f
0x01769125
0x01769127
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: f841151062a43f2d70b0b423240ced7042a294ed31ecba1e3057d9f0eadf2431
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: E0218071A00205EFDB21DF59C844AAAFBFCEF54714F1488AAEA45A7200D730ED04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01753B7A Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E01753B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x18184c4; // 0x0
				_v12 = 1;
				_v8 =  *0x18184c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x18184c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E0176AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E0176FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x18184c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x18184c4; // 0x0
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x01753b89
0x01753b96
0x01753ba1
0x01753bab
0x01753bb5
0x01753bb9
0x01796298
0x01753bbf
0x01753bc2
0x01753bc3
0x01753bc9
0x01753bca
0x01753bcc
0x01753bcd
0x01753bd4
0x01753bd6
0x01753bdb
0x01753bea
0x01753bf7
0x01753bfb
0x01753bff
0x01753c09
0x01753c0a
0x01753c0b
0x01753c0f
0x01753c14
0x01753c18
0x01753c18
0x01753bfb
0x01753c1b
0x01753c30
0x01753c30
0x01753c3d

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fdce755023df357802fbe044d53e757b1c4572dc79906472c77a9eedec118fa
Instruction ID: 7acfdf19f4b641586f978b7f54ddef2e57929f0541fd0fc8b0d29ff88cbe0426
Opcode Fuzzy Hash: 6fdce755023df357802fbe044d53e757b1c4572dc79906472c77a9eedec118fa
Instruction Fuzzy Hash: B9219F72A00109AFC715DF58DD81F5AFBBDFB45748F1500A8EA09AB251D771EE01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 017A6CF0 Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E017A6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E01747D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E01747D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x1705c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0175F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0175F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E017A7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L01742400( &_v52);
								}
								_t21 = L01742400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x017a6cfb
0x017a6d00
0x017a6d02
0x017a6d06
0x017a6d0a
0x017a6d0e
0x017a6d19
0x017a6d2b
0x017a6d1b
0x017a6d24
0x017a6d24
0x017a6d33
0x017a6d39
0x017a6d46
0x017a6d4f
0x017a6d61
0x017a6d51
0x017a6d5a
0x017a6d5a
0x017a6d69
0x017a6d6b
0x017a6d6d
0x017a6d6f
0x017a6d6f
0x017a6d74
0x017a6d79
0x017a6d7a
0x017a6d7f
0x017a6d82
0x017a6d88
0x017a6d89
0x017a6d90
0x017a6d94
0x017a6da7
0x017a6db1
0x017a6db1
0x017a6dbb
0x017a6dbb
0x017a6d90
0x017a6d69
0x017a6d46
0x017a6dc6

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676a351d02b93aa4d0a2d8b5d0f426e3e8fcb400d627fe6561c52e3cc241cd4d
Instruction ID: 8b58d6e387b8e91154036bede08f58e14175bb0da64386f19a5032eba606b52a
Opcode Fuzzy Hash: 676a351d02b93aa4d0a2d8b5d0f426e3e8fcb400d627fe6561c52e3cc241cd4d
Instruction Fuzzy Hash: 1321D3725046459BDB11DF28C948B67FBECEFD1680F480656FA5087251E734C988C6E2

Uniqueness

Uniqueness Score: -1.00%

Function 017F070D Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E017F070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E017F07DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E017EAFDE( &_v8,  &_v12);
					E017F1293(_t38, _v28, _t60);
					if(E01747D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E017E14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x017f071b
0x017f0724
0x017f0734
0x017f0738
0x017f074b
0x017f074b
0x017f0753
0x017f0753
0x017f0759
0x017f075d
0x017f0774
0x017f0779
0x017f077d
0x017f0789
0x017f0795
0x017f07a7
0x017f0797
0x017f07a0
0x017f07a0
0x017f07af
0x017f07c4
0x017f07cd
0x017f07cd
0x017f07af
0x017f07dc

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 1235fb0f74113fdf93fce5dbd3f26d9cd95d736c8a8a273645031002a85d926c
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: E021F2362042009FDB15DF18C884B6BBBE6EBD4350F0485ADFA958B396D730D919CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017A7794 Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E017A7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x1817b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E0176F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E01747D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E01769AE0();
					_t24 = L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x017a7799
0x017a779a
0x017a779b
0x017a77a3
0x017a77ab
0x017a77ae
0x017a77b1
0x017a77b1
0x017a77bf
0x017a77c4
0x017a77c8
0x017a77ce
0x017a77d4
0x017a77e0
0x017a77e0
0x017a77d6
0x017a77d6
0x017a77de
0x00000000
0x00000000
0x017a77de
0x017a77e5
0x017a77f0
0x017a77f3
0x017a77f6
0x017a77fd
0x017a7800
0x017a780c
0x017a7818
0x017a782b
0x017a781a
0x017a7823
0x017a7823
0x017a7830
0x017a7831
0x017a7838
0x017a783d
0x017a783e
0x017a784f
0x017a784f
0x017a785a

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5971fa5f0640a27b824c02908607ba675413d4ae2ce18f86fb7cf35958714bab
Instruction ID: f4ecdc75d15b1b55e7994cc2f1cb9b9b23f94835d93f302aa003e59387d82100
Opcode Fuzzy Hash: 5971fa5f0640a27b824c02908607ba675413d4ae2ce18f86fb7cf35958714bab
Instruction Fuzzy Hash: 4E219D72900604ABC729DF69D894E6BBBA9EF88740F10066DEA0AC7650D735E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0174AE73 Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0174AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E01747D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E01747D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E01747D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E01747D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E017A7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x0174ae78
0x0174ae7c
0x0174ae7e
0x0174ae81
0x0174ae86
0x0174ae8d
0x01792691
0x0174ae93
0x0174ae93
0x0174ae93
0x0174ae98
0x0174ae9d
0x017926a2
0x017926b4
0x017926a4
0x017926ad
0x017926ad
0x017926b9
0x00000000
0x017926bb
0x00000000
0x017926bb
0x0174aea3
0x0174aea3
0x0174aea3
0x0174aeaa
0x017926c0
0x017926c9
0x017926c9
0x0174aeb3
0x017926d4
0x017926e1
0x00000000
0x00000000
0x017926e7
0x017926ee
0x017926f0
0x017926f9
0x017926f9
0x01792702
0x01792708
0x01792708
0x0179270b
0x0179270f
0x01792711
0x01792711
0x01792725
0x01792725
0x00000000
0x0174aeb9
0x0174aeb9
0x0174aebf
0x0174aebf
0x0174aeb3

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: cc66bc36ded4e4d9a45f72328e82508cd9778123371c00f918dd64562d8fe4b3
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 5221A472605691AFEB26EB6DD948B25FBE8EF44750F1A00E0DE058BAA3D734DC44C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 0175FD9B Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0175FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E017376E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x0175fd9b
0x0175fda0
0x0175fda1
0x0175fdab
0x0175fdad
0x0175fdb0
0x0175fdb8
0x0175fe0f
0x0175fde6
0x0175fde9
0x0175fdec
0x0179c0c0
0x0175fdfe
0x0175fe06
0x0175fe06
0x0179c0c8
0x0175fe2d
0x0175fe2d
0x00000000
0x0175fe2d
0x0179c0d1
0x0179c0e0
0x0179c0e5
0x0179c0e5
0x0179c0e8
0x00000000
0x0179c0e8
0x0175fdf4
0x00000000
0x00000000
0x0175fdf6
0x0175fdfa
0x0175fe1a
0x0175fe1f
0x0175fe1f
0x0175fdfc
0x00000000
0x0175fdfc
0x0175fdcc
0x0175fdd0
0x0175fe26
0x00000000
0x0175fe26
0x0175fdd8
0x0175fddb
0x0175fddd
0x0175fde0
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: d7024841e48357e19155bbf1c3a8b51d9fbde8330db961d894c16643eb68982f
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 5721BB72600A40DFDB76CF0DCA40E62F7E5EB98B10F2084BEE94987A19D771AC41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0175B390 Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0175B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E01742280(_t12, 0x1818608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E017600C2(0x1818608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x0175b395
0x0175b3a2
0x0175b3a5
0x0175b3aa
0x0175b3b2
0x0175b3ba
0x0175b3bd
0x0175b3c0
0x0175b3c4
0x0175b3c9
0x0179a3e9
0x0179a3ed
0x0179a3f0
0x0179a3ff
0x0179a403
0x0179a409
0x00000000
0x00000000
0x0179a40b
0x0179a40b
0x0179a40f
0x0179a415
0x0179a423
0x0179a423
0x0179a415
0x0175b3d1
0x0175b3e8
0x0175b3e8
0x0175b3d9

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e40bf2916d914b90ca7b08f1e27132bf9d661a06d4fa7b4e28442a6f076857
Instruction ID: 2252f86ce0242fbf755ca16ac2f976fe110e5ab22322c76f0f2f35eb9109947f
Opcode Fuzzy Hash: 59e40bf2916d914b90ca7b08f1e27132bf9d661a06d4fa7b4e28442a6f076857
Instruction Fuzzy Hash: F81166333061109FCB29CA189D81A3BF26BEBD6370F290139EE16D7391CA71AC06C690

Uniqueness

Uniqueness Score: -1.00%

Function 01729240 Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E01729240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x17ff708);
				E0177D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E017695D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E017695D0();
				_t33 =  *0x18184c4; // 0x0
				L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x18184c4; // 0x0
				L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x18184c4; // 0x0
				E01742280(L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x18186b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E017695D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E017695D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E01729325();
					_t50 =  *0x18184c4; // 0x0
					return E0177D0D1(L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x01729240
0x01729242
0x01729247
0x0172924c
0x0172924e
0x01729255
0x01729257
0x0172925a
0x0172925f
0x0172925f
0x01729266
0x01729271
0x01729276
0x01729279
0x0172927e
0x01729295
0x0172929a
0x017292b1
0x017292b6
0x017292d7
0x017292dc
0x017292e0
0x017292e6
0x017292e8
0x017292ee
0x01729332
0x01729333
0x01729337
0x01729338
0x0172933a
0x0172933a
0x0172933d
0x01729342
0x01729342
0x01729345
0x01729349
0x0172934e
0x01729352
0x01729357
0x017292f4
0x017292f4
0x017292f6
0x017292f9
0x01729300
0x01729306
0x01729324
0x01729324

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5475215c2ad370f52b72b6e207af15b202413137d51c00b800fbfdd4e67b14b3
Instruction ID: c9ec76b3c755baf9f2ce23a9f67b1106dea89da42b33b5b99ba81b24c32d53a9
Opcode Fuzzy Hash: 5475215c2ad370f52b72b6e207af15b202413137d51c00b800fbfdd4e67b14b3
Instruction Fuzzy Hash: 5C215932040611DFC726EF68CA84F1AF7B9FF18708F14456CE209866A6CB34E942CB44

Uniqueness

Uniqueness Score: -1.00%

Function 017B4257 Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E017B4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x18008d0);
				E0177D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E017B41E8(__ebx, __edi, __ecx, _t39);
				E0173EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x18187e4;
					_t18 =  *0x18187e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x1815cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x18187e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x18187e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L01727055(_t31 + 0xfffffff8);
								_t24 =  *0x18187e0; // 0x0
								_t18 = _t24 - 1;
								 *0x18187e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x1815cd0;
				if( *0x1815cd0 <= 0) {
					L01727055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x18187e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x18187e8 = _t30;
						 *0x18187e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E0177D0D1(L017B4320());
			}

0x017b4257
0x017b4257
0x017b4257
0x017b4259
0x017b425e
0x017b4263
0x017b4265
0x017b4273
0x017b4278
0x017b427c
0x017b427f
0x017b4281
0x017b4287
0x017b42d7
0x017b42d7
0x017b42da
0x017b428d
0x017b428d
0x017b428f
0x017b4292
0x017b4297
0x017b429c
0x017b42a0
0x017b42a6
0x017b42a8
0x017b42ae
0x017b42b3
0x00000000
0x017b42ba
0x017b42ba
0x017b42bf
0x017b42c5
0x017b42ca
0x017b42cf
0x017b42d0
0x00000000
0x017b42d0
0x017b42b3
0x00000000
0x017b42a6
0x017b429c
0x017b42dc
0x017b42dc
0x017b42e3
0x017b4309
0x017b42e5
0x017b42e5
0x017b42e8
0x017b42ee
0x017b42f0
0x00000000
0x017b42f2
0x017b42f2
0x017b42f4
0x017b42f7
0x017b42f9
0x017b4300
0x017b4300
0x017b42f0
0x017b430e
0x017b431f

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df6779b97b4c0148ad2284616b737677563628fa2e6369f9edc489f896bebb6
Instruction ID: 48840221ef799211a4fb714d875e1a22672f2e30f4a8d2cc6e7bd1392c489297
Opcode Fuzzy Hash: 6df6779b97b4c0148ad2284616b737677563628fa2e6369f9edc489f896bebb6
Instruction Fuzzy Hash: 10218872901601CFCB26DF68D084B94FBA4FB86354B5486AAC1578B39ADB308692CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01752397 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E01752397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x181848c != 0) {
					L0174FAD0(0x1818610);
					if( *0x181848c == 0) {
						E0174FA00(0x1818610, _t19, _t27, 0x1818610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E01752581(0x1818610, 0x17050a0, _t26, _t27, _t28);
						E0174FA00(0x1818610, 0x17050a0, _t27, 0x1818610);
					}
				} else {
					L1:
					_t11 =  *0x1818614; // 0x0
					if(_t11 == 0) {
						_t11 = E01764886(0x1701088, 1, 0x1818614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E01752581(0x1818610, (_t11 << 4) + 0x1705070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x017523b0
0x017523b6
0x01752409
0x01752415
0x01795ae9
0x00000000
0x0175241b
0x0175241b
0x0175241d
0x01752427
0x0175242e
0x01752430
0x01752430
0x017523b8
0x017523b8
0x017523b8
0x017523bf
0x017523fc
0x017523fc
0x017523c1
0x017523c3
0x017523d0
0x017523d8
0x017523d8
0x017523dc
0x017523de
0x017523e1
0x017523e1
0x017523ec

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c1758b699be7647c9852a6843f4edea873fcb1c1103ab921432db3c743297d
Instruction ID: a2384ad4aaa64ae2f361919c13c54485eedc06b5ceace2a40b203941049a2eb4
Opcode Fuzzy Hash: d9c1758b699be7647c9852a6843f4edea873fcb1c1103ab921432db3c743297d
Instruction Fuzzy Hash: 58114832744301EBE3719A3DAC88B15F6CCEBA1610F14446AEA0297286CAF0D9008B54

Uniqueness

Uniqueness Score: -1.00%

Function 017A46A7 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E017A46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E0176F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0175D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L017477F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x017a46b7
0x017a46ba
0x017a46c5
0x017a46c8
0x017a46d0
0x017a46d4
0x017a46e6
0x017a46e9
0x017a46f4
0x017a46ff
0x017a4705
0x017a4706
0x017a470c
0x017a4713
0x017a471b
0x017a4723
0x017a4725
0x017a46d6
0x017a46d9
0x017a46db
0x017a46db
0x017a4732

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 196513d77632b116eb53eaf6d935a24a8d8eb65bbda7403038b2da6e91459344
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: F8112572504208BBC7069F5CD8809BEFBB9EF95300F1080AAF944C7350DA328D51D3A5

Uniqueness

Uniqueness Score: -1.00%

Function 017637F5 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E017637F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E01742280(_t6, 0x1818550);
				}
				_t29 = E0176387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E0173FFB0(0x1818550, _t27, 0x1818550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x017637fa
0x017637fc
0x01763805
0x01763808
0x01763808
0x01763814
0x01763818
0x01763846
0x01763848
0x0176384b
0x0176384b
0x01763852
0x00000000
0x01763854
0x01763856
0x00000000
0x00000000
0x01763863
0x00000000
0x01763863
0x0176381a
0x0176381a
0x0176381f
0x0176386e
0x0176386e
0x01763871
0x01763873
0x01763873
0x01763868
0x00000000
0x01763868
0x01763821
0x01763826
0x00000000
0x00000000
0x01763828
0x0176382a
0x01763841
0x00000000
0x01763841

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab62885f7c2ce17494a7789e03902bf889cd86ccb4e660b10039e75f2fde1a9d
Instruction ID: 52c20fcb49b1e9c26409a8dc952015528441f4df1d0b09dc4b89590988b93bf1
Opcode Fuzzy Hash: ab62885f7c2ce17494a7789e03902bf889cd86ccb4e660b10039e75f2fde1a9d
Instruction Fuzzy Hash: 9601C4729856129BC3378B1D9940A6AFBAEFF86A617154069ED4D9B216DB30C801C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0175002D Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0175002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E01747D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E01747D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E01747D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E01747D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x01750032
0x01750037
0x01750043
0x01794b3a
0x01750049
0x01750049
0x01750049
0x0175004e
0x01750053
0x01794b48
0x01794b5a
0x01794b4a
0x01794b53
0x01794b53
0x01794b5f
0x00000000
0x01794b61
0x00000000
0x01794b61
0x01750059
0x01750059
0x01750060
0x01794b6f
0x01794b6f
0x01750069
0x01794b83
0x00000000
0x00000000
0x01794b90
0x01794b9b
0x01794b9b
0x01794ba4
0x00000000
0x00000000
0x01794baa
0x00000000
0x0175006f
0x0175006f
0x00000000
0x0175006f
0x01750069

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: d01c2bd8d05e26762350ed95e6847e98112cf0c5111e196b7b97d24b516be000
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: AC11D6326156C18FEB239B2CDA58B35FBD4EF41754F0A00E0ED0A87A93D779D886C660

Uniqueness

Uniqueness Score: -1.00%

Function 0173766D Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0173766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0175F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0175F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L01744620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x01737672
0x0173767f
0x01737689
0x017376de
0x017376de
0x0173768b
0x01737691
0x01737693
0x01737697
0x00000000
0x01737699
0x017376a8
0x00000000
0x017376aa
0x017376ad
0x017376b1
0x00000000
0x017376b3
0x017376b3
0x017376b5
0x017376ba
0x017376bc
0x017376bc
0x017376c0
0x00000000
0x017376c2
0x017376ce
0x017376ce
0x017376c0
0x017376b1
0x017376a8
0x01737697
0x017376d9

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 7b20f9cc9ae0f74e6a34ba715ea7559a15afafc62ffae6f9e10e3cd4160207bd
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: D901D873300119EBD7249E5ECC94E5BFBADEBC4760B140124BA08CB245DA30DC11A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 01729080 Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01729080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x18185ec;
				E01742280(_t48, 0x18185ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0173FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x181538c; // 0x77496828
					if( *_t84 != 0x1815388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x17ff6e8);
						E0177D0E8(0x18185ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E017F88F5(_t80, _t85, 0x1815388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x18186c0; // 0x11207b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x18186b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E01742280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E017F88F5(0x18185ec, _t85, 0x1815388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E0176AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x181b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x18184c0;
																			if(_t82 >=  *0x18184c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E017F9063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0172922A(_t99);
										_t64 = E01747D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E017F8B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x18186c0; // 0x11207b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x18186b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x18186bc;
													_t87 = 0x18186b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E01729240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x18186c4;
												_t87 = 0x18186c0;
												L27:
												E01759B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E0177D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x1815388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x181538c = _t51;
						goto L6;
					}
				}
			}

0x01729082
0x01729083
0x01729084
0x01729085
0x01729087
0x01729096
0x01729098
0x01729098
0x0172909e
0x017290a8
0x017290e7
0x017290e7
0x017290aa
0x017290b0
0x017290b7
0x017290bd
0x017290dd
0x017290e6
0x017290bf
0x017290bf
0x017290c7
0x017290cf
0x017290f1
0x017290f2
0x017290f4
0x017290f5
0x017290f6
0x017290f7
0x017290f8
0x017290f9
0x017290fa
0x017290fb
0x017290fc
0x017290fd
0x017290fe
0x017290ff
0x01729100
0x01729102
0x01729107
0x0172910c
0x01729110
0x01729113
0x01729115
0x01729136
0x0172913f
0x01729143
0x017837e4
0x017837e4
0x01729117
0x01729117
0x0172911d
0x00000000
0x0172911f
0x0172911f
0x01729125
0x00000000
0x01729127
0x0172912d
0x01729130
0x01729134
0x01729158
0x0172915d
0x01729161
0x01729168
0x01783715
0x0172916e
0x0172916e
0x01729175
0x01729177
0x0172917e
0x0172917f
0x01729182
0x01729182
0x01729187
0x01729187
0x0172918a
0x0172918d
0x0172918f
0x01729192
0x01729195
0x01729198
0x01729198
0x01729198
0x0172919a
0x00000000
0x00000000
0x0178371f
0x01783721
0x01783727
0x0178372f
0x01783733
0x01783735
0x01783738
0x0178373b
0x0178373d
0x01783740
0x00000000
0x01783746
0x01783746
0x01783749
0x00000000
0x0178374f
0x0178374f
0x01783751
0x01783757
0x01783759
0x0178375c
0x0178375c
0x0178375e
0x0178375e
0x01783761
0x01783764
0x00000000
0x00000000
0x01783766
0x01783768
0x017837a3
0x017837a3
0x017837a5
0x017837a7
0x017837ad
0x017837b0
0x017837b2
0x017837bc
0x017837c2
0x017837c2
0x017837b2
0x01729187
0x01729187
0x0172918a
0x0172918d
0x0172918f
0x01729192
0x01729195
0x00000000
0x01729195
0x00000000
0x0178376a
0x0178376a
0x0178376a
0x0178376c
0x0178376c
0x0178376f
0x01783775
0x00000000
0x00000000
0x01783777
0x01783779
0x01783782
0x01783787
0x01783789
0x01783790
0x01783790
0x0178378b
0x0178378b
0x0178378b
0x01783792
0x01783795
0x00000000
0x01783795
0x00000000
0x01783779
0x01783798
0x00000000
0x01783798
0x00000000
0x01783768
0x0178379b
0x0178379b
0x01783751
0x01783749
0x00000000
0x01783740
0x017291a0
0x017291a3
0x017291a9
0x017291b0
0x00000000
0x017291b0
0x01729187
0x017291b4
0x017291b4
0x017291bb
0x017291c0
0x017291c5
0x017291c7
0x017837da
0x017291cd
0x017291cd
0x017291cd
0x017291d2
0x017291d5
0x01729239
0x01729239
0x017291d7
0x017291db
0x017291e1
0x017291e7
0x017291fd
0x01729203
0x0172921e
0x01729223
0x00000000
0x01729205
0x01729205
0x01729208
0x0172920c
0x01729214
0x01729214
0x0172920c
0x017291e9
0x017291e9
0x017291ee
0x017291f3
0x017291f3
0x017291f3
0x017291e7
0x00000000
0x00000000
0x00000000
0x01729134
0x01729125
0x0172911d
0x0172914e
0x017290d1
0x017290d1
0x017290d3
0x017290d6
0x017290d8
0x00000000
0x017290d8
0x017290cf

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac9cca396a35d4af95086352d441fc5d3fd63ee062eb56a482a9ad2ea173990
Instruction ID: 588fe35c7610f68bad952f982ef08c47e7c14953e956bfb6d1005d96b1ad7071
Opcode Fuzzy Hash: 9ac9cca396a35d4af95086352d441fc5d3fd63ee062eb56a482a9ad2ea173990
Instruction Fuzzy Hash: F501F47350122A8FD3358F08D840B11FBA9EF83324F294166E701CB696C378DD42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017BC450 Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E017BC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E01769910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E017695B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E017695D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E017695D0();
				return L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x017bc458
0x017bc45d
0x017bc466
0x017bc468
0x017bc469
0x017bc46a
0x017bc46b
0x017bc46e
0x017bc46f
0x017bc471
0x017bc476
0x017bc476
0x017bc47c
0x017bc47e
0x017bc480
0x017bc480
0x017bc483
0x017bc484
0x017bc486
0x017bc488
0x017bc48f
0x017bc491
0x017bc493
0x017bc493
0x017bc48f
0x017bc498
0x017bc49e
0x017bc4ad
0x017bc4ad
0x017bc4b2
0x017bc4b4
0x017bc4cd

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 3198803763ce0b70611504f8acb08701ec3df88bb2ee8b5f30a325ce5607dd63
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 7A01B572140506BFE726AF69CC84EA2FB6DFF64394F108525F714425A4CB35ECA1CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 017F4015 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E017F4015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E01742280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E01742280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x18186ac);
					E0172F900(0x18186d4, _t28);
					E0173FFB0(0x18186ac, _t28, 0x18186ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0173FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x017f401a
0x017f401e
0x017f4023
0x017f4028
0x017f4029
0x017f402b
0x017f402f
0x017f4043
0x017f4046
0x017f4051
0x017f4057
0x017f405f
0x017f4062
0x017f4067
0x017f406f
0x017f407c
0x017f407c
0x017f408c
0x017f408c
0x017f4097

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a65c698f21de79bd718f2b84b5518466e551436890f38ce14408fb2901870cb
Instruction ID: 1500e476fe3c0174aa85afad1227953b57e8a64112163ab56e88b542dd06bb18
Opcode Fuzzy Hash: 6a65c698f21de79bd718f2b84b5518466e551436890f38ce14408fb2901870cb
Instruction Fuzzy Hash: 4501A2726019467FD211AB79CD88E13F7ACFF95760B000629F608C3A26CB24EC11CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 017E138A Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E017E138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x181d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0176FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E01747D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0176B640(E01769AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x017e138a
0x017e138a
0x017e1399
0x017e13a3
0x017e13a8
0x017e13aa
0x017e13b5
0x017e13bb
0x017e13c3
0x017e13c6
0x017e13c9
0x017e13d4
0x017e13e6
0x017e13d6
0x017e13df
0x017e13df
0x017e13f1
0x017e13f2
0x017e13f4
0x017e13f9
0x017e140e

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cd7df74606626d395c110998a6f1327fba793da09bb4022ad1e54df651f313
Instruction ID: e7722a817805f185abf8047162a998ea7128ff0d082d66116cca11147e7d5544
Opcode Fuzzy Hash: 89cd7df74606626d395c110998a6f1327fba793da09bb4022ad1e54df651f313
Instruction Fuzzy Hash: 8C015271A00319AFDB14DFA9D846FAEFBF8EF55710F404056F904EB280DA749A41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 017E14FB Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E017E14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x181d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0176FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E01747D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0176B640(E01769AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x017e14fb
0x017e14fb
0x017e150a
0x017e1514
0x017e1519
0x017e151b
0x017e1526
0x017e152c
0x017e1534
0x017e1537
0x017e153a
0x017e1545
0x017e1557
0x017e1547
0x017e1550
0x017e1550
0x017e1562
0x017e1563
0x017e1565
0x017e156a
0x017e157f

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2fb43eeaa8ce3e44ea3bd414b548da0359bb3b08ba4c98f4b37cfc1d3161f9
Instruction ID: d0aea03f9ba3cc01bf1a0846e18d74b9144d64e096aec902635ba018194f618b
Opcode Fuzzy Hash: 1e2fb43eeaa8ce3e44ea3bd414b548da0359bb3b08ba4c98f4b37cfc1d3161f9
Instruction Fuzzy Hash: FF019271A00258AFCB14DFA8D84AEAEFBFCEF45700F404056F904EB280DA70DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 017258EC Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E017258EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x181d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x1705c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E01725943() != 0 &&  *0x1815320 > 5) {
					E017A7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E017A7B5E( &_v28, _t28);
					_t11 = E017A7B9C(0x1815320, 0x170bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E0176B640(_t11, _t17, _v8 ^ _t29, 0x170bf15, _t27, _t28);
			}

0x017258fb
0x017258fe
0x01725906
0x0172590a
0x0172593c
0x0172593c
0x0172590c
0x0172590c
0x01725911
0x00000000
0x01725913
0x01725913
0x01725913
0x01725911
0x0172591d
0x01781035
0x0178103c
0x0178103f
0x01781056
0x01781056
0x0172593b

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee7a9d5a3be5401bc5a79e2681deeeb2017d9f7a73a81eba22b7b192f0e6c77
Instruction ID: ab54abbd02232143cd3ec3d8f2f349c757719cb71cce37ba374f935a7ff00361
Opcode Fuzzy Hash: 4ee7a9d5a3be5401bc5a79e2681deeeb2017d9f7a73a81eba22b7b192f0e6c77
Instruction Fuzzy Hash: E901A772B00115DBC714EA69DC049EEF7ADEF92120F954169DA45D7248DE31DE07C750

Uniqueness

Uniqueness Score: -1.00%

Function 017F1074 Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017F1074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E017F165E(__ebx, 0x1818ae4, (__edx -  *0x1818b04 >> 0x14) + (__edx -  *0x1818b04 >> 0x14), __edi, __ecx, (__edx -  *0x1818b04 >> 0x14) + (__edx -  *0x1818b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E017EAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E01747D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E017DFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x017f1074
0x017f1080
0x017f1082
0x017f108a
0x017f108f
0x017f1093
0x017f10ab
0x017f10ab
0x017f10c3
0x017f10cf
0x017f10e1
0x017f10d1
0x017f10da
0x017f10da
0x017f10e9
0x017f10f5
0x017f10f5
0x017f10fe

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff215d96625d70dbd67179192f4d08ecf74ff565e2ffb206872b8a5d81cd7b6c
Instruction ID: ea8d062e610cd7b71aa78b18d29ecbcb6139dff0c028840125051dfcd14c0637
Opcode Fuzzy Hash: ff215d96625d70dbd67179192f4d08ecf74ff565e2ffb206872b8a5d81cd7b6c
Instruction Fuzzy Hash: 5A012872604746DBC710DF28C944B1BFBE9AB84310F44C529FA8583394DE30D541CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0173B02A Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0173B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E01747D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E017A7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x0173b037
0x0173b039
0x0173b03b
0x0173b040
0x0178a60e
0x00000000
0x00000000
0x0178a61d
0x0173b04b
0x0173b04e
0x0178a627
0x0178a634
0x00000000
0x00000000
0x0178a641
0x0178a653
0x0178a643
0x0178a64c
0x0178a64c
0x0178a65b
0x00000000
0x00000000
0x00000000
0x0178a66c
0x0173b057
0x0173b057
0x0173b057
0x0173b046
0x0173b046
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 953ba90b9c05cfa7a9b972ed2f45b0d18eacfd2b3b1a32bdee2845ab021bd94b
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: A1018F723449809FE726971DC988F66FBD8EBC5754F0900A2FA19CBA56D728DC40C621

Uniqueness

Uniqueness Score: -1.00%

Function 017DFE3F Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E017DFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x181d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0176FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E01747D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0176B640(E01769AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x017dfe3f
0x017dfe3f
0x017dfe4e
0x017dfe58
0x017dfe5d
0x017dfe5f
0x017dfe6a
0x017dfe72
0x017dfe75
0x017dfe78
0x017dfe83
0x017dfe95
0x017dfe85
0x017dfe8e
0x017dfe8e
0x017dfea0
0x017dfea1
0x017dfea3
0x017dfea8
0x017dfebd

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1485917e7cc07c2dedef5e6f5dc4d14473f3942b2e4f06a4bfac434426c628ae
Instruction ID: 525433b1c05473104ff9bd4f3cd3b9cd08aea983501afb90b1bf720a7cadac48
Opcode Fuzzy Hash: 1485917e7cc07c2dedef5e6f5dc4d14473f3942b2e4f06a4bfac434426c628ae
Instruction Fuzzy Hash: BE018471A0021DAFDB14DFA9D845FAEFBBCEF54700F004066F901EB281DA709A01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 017DFEC0 Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E017DFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x181d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0176FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E01747D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0176B640(E01769AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x017dfec0
0x017dfec0
0x017dfecf
0x017dfed9
0x017dfede
0x017dfee0
0x017dfeeb
0x017dfef3
0x017dfef6
0x017dfef9
0x017dff04
0x017dff16
0x017dff06
0x017dff0f
0x017dff0f
0x017dff21
0x017dff22
0x017dff24
0x017dff29
0x017dff3e

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7afa9521c1dd42ff71e287496c2ab0e356a080e375fbe2d50d0eafafafd767
Instruction ID: 0dd583569304a1391bd066374dbb0c324bbd0f34612c3077c80c4172f24f8a82
Opcode Fuzzy Hash: 2d7afa9521c1dd42ff71e287496c2ab0e356a080e375fbe2d50d0eafafafd767
Instruction Fuzzy Hash: 8E018471A0021DAFDB14DFA9D849FAEFBBCEF55700F404066F901EB280EA709A01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 017F8A62 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E017F8A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x181d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E01747D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0176B640(E01769AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x017f8a62
0x017f8a71
0x017f8a79
0x017f8a82
0x017f8a85
0x017f8a89
0x017f8a8c
0x017f8a8f
0x017f8a92
0x017f8a95
0x017f8a9f
0x017f8ab1
0x017f8aa1
0x017f8aaa
0x017f8aaa
0x017f8abc
0x017f8abd
0x017f8abf
0x017f8ac4
0x017f8ada

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac4cf84011854617aed3892cf328d1b230ec6bd5d95a09d69e3dca45161dbcb
Instruction ID: 90f610716756d5d5324b5d62982de7cb78ba5c0762b2e9e0225e05e4ab5a36f3
Opcode Fuzzy Hash: 0ac4cf84011854617aed3892cf328d1b230ec6bd5d95a09d69e3dca45161dbcb
Instruction Fuzzy Hash: 5B012C71A0021DAFCB04DFA9D9459AEFBB8EF58310F10405AFA04E7341EB34AA00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017F8ED6 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E017F8ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x181d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E01747D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E0176B640(E01769AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x017f8ed6
0x017f8ee5
0x017f8eed
0x017f8ef0
0x017f8efa
0x017f8f03
0x017f8f0c
0x017f8f15
0x017f8f24
0x017f8f27
0x017f8f31
0x017f8f43
0x017f8f33
0x017f8f3c
0x017f8f3c
0x017f8f4e
0x017f8f4f
0x017f8f51
0x017f8f56
0x017f8f69

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b21ab23820c0afbd105b66cc185c19bc589ed306639eabe40a5a1567c6de3a
Instruction ID: e029ea95d73920e5ab7cda244346c7bb4170760dfa3fe637a6fe8908640f9215
Opcode Fuzzy Hash: 74b21ab23820c0afbd105b66cc185c19bc589ed306639eabe40a5a1567c6de3a
Instruction Fuzzy Hash: 75111E71A042199FDB04DFA8D445BAEFBF4FF08300F0442AAE918EB381E6349A40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0172DB60 Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0172DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0172DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0172E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0172E8B0(__ecx, _t14, 0xfff);
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x0172db64
0x0172db66
0x0172db6b
0x0172dbaa
0x0172db71
0x0172db76
0x0172db7a
0x0172dba3
0x0172db7c
0x0172db87
0x0172db8b
0x01784fa1
0x01784fb3
0x01784fb8
0x0172db91
0x0172db96
0x0172db98
0x0172db98
0x0172db8b
0x0172db7a
0x0172db9d
0x0172dba2

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 0cb4341fdc1936779609a73bbd3e81722c1901b6acaaed4dd66b93c74bcd620f
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 69F09C332455339BD7336AD9C8A4F57FA969FD2A60F150475F2059B348CE608C0396D1

Uniqueness

Uniqueness Score: -1.00%

Function 0172B1E1 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0172B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E01747D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E01747D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E017A7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x0172b1e8
0x0172b1ea
0x0172b1f3
0x01784a17
0x0172b1f9
0x0172b1f9
0x0172b1f9
0x0172b201
0x01784a21
0x01784a2e
0x00000000
0x00000000
0x01784a3b
0x01784a4d
0x01784a3d
0x01784a46
0x01784a46
0x01784a55
0x00000000
0x00000000
0x00000000
0x0172b20a
0x0172b20a
0x0172b20a
0x0172b20a

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 6ae7a85365034bf8c0e1d94e9413c90a60afebbb6ec2eec5ea44e1d89abbe05a
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 22014432240680DBD322A76DC808F6AFBD8EF92350F0904A1FA058B2B2D7B8C900C315

Uniqueness

Uniqueness Score: -1.00%

Function 017BFE87 Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E017BFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x181d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E01747D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0176B640(E01769AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x017bfe96
0x017bfe9e
0x017bfea1
0x017bfead
0x017bfeb3
0x017bfeb9
0x017bfec3
0x017bfed5
0x017bfec5
0x017bfece
0x017bfece
0x017bfee0
0x017bfee1
0x017bfee3
0x017bfee8
0x017bfefb

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ef982f566425b54e2e4140d350f44d51681fd111315b7028b4f8fb77ed8bbd
Instruction ID: 32bc28b3ee8f23ba98421af40aee13beadd7f917f70576fa9749484bed99dacb
Opcode Fuzzy Hash: 33ef982f566425b54e2e4140d350f44d51681fd111315b7028b4f8fb77ed8bbd
Instruction Fuzzy Hash: 5A016271A00209AFCB14DFA8D545A6EF7F4EF18704F144199E904DB382DA35DA01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 017E131B Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E017E131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x181d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E01747D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0176B640(E01769AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x017e131b
0x017e132a
0x017e1330
0x017e1336
0x017e133e
0x017e1341
0x017e1344
0x017e134f
0x017e1361
0x017e1351
0x017e135a
0x017e135a
0x017e136c
0x017e136d
0x017e136f
0x017e1374
0x017e1387

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c37059f0c0be466c32f4460995899965ab0f0d9e1f5e01cc8813114d4ababd
Instruction ID: 20e2a324dcc9c57a677988765cefd8107d09bca14326d85275875663d66bd411
Opcode Fuzzy Hash: 92c37059f0c0be466c32f4460995899965ab0f0d9e1f5e01cc8813114d4ababd
Instruction Fuzzy Hash: E2013C71A01209AFCB04EFA9D549AAEF7F8FF18700F508059FD45EB381EA349A00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 017F8F6A Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E017F8F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x181d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E01747D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E0176B640(E01769AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x017f8f6a
0x017f8f79
0x017f8f81
0x017f8f84
0x017f8f8b
0x017f8f91
0x017f8f94
0x017f8f9e
0x017f8fb0
0x017f8fa0
0x017f8fa9
0x017f8fa9
0x017f8fbb
0x017f8fbc
0x017f8fbe
0x017f8fc3
0x017f8fd6

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c4822fa783e00d113ff6ce9ddca6ef4d8a3da2d339b7e266a2cae96c7de38c
Instruction ID: bafcae5f176d27090ce541d2a22ca8cb654ae5a08091b2b76e83a1236b59d7ec
Opcode Fuzzy Hash: 53c4822fa783e00d113ff6ce9ddca6ef4d8a3da2d339b7e266a2cae96c7de38c
Instruction Fuzzy Hash: 2E013175A00209AFDB04DFA8D545AAEF7F4EF18300F504459BA05EB381EA34DA00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 017E1608 Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E017E1608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x181d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E01747D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E0176B640(E01769AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x017e1608
0x017e1617
0x017e161d
0x017e1625
0x017e1628
0x017e162b
0x017e1636
0x017e1648
0x017e1638
0x017e1641
0x017e1641
0x017e1653
0x017e1654
0x017e1656
0x017e165b
0x017e166e

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9fb9eae94e5f7d63dde68256a4c9f7f138ddf1c5a49037c3b79e52bae88a40
Instruction ID: 998c918fd803df235372991d537680204fcb5a481604b93a8bc898f455c82a5b
Opcode Fuzzy Hash: 1f9fb9eae94e5f7d63dde68256a4c9f7f138ddf1c5a49037c3b79e52bae88a40
Instruction Fuzzy Hash: 75F06271A00258EFDB14DFA8D409A6EF7F8FF18300F444069E905EB381EA349A00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0174C577 Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0174C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0174C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x17011cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E017F88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0174c577
0x0174c57d
0x0174c581
0x0174c5b5
0x0174c5b9
0x0174c5ce
0x0174c5ce
0x0174c5ca
0x00000000
0x0174c5ca
0x0174c5c4
0x0174c5c8
0x00000000
0x00000000
0x00000000
0x0174c5ad
0x00000000
0x0174c5af

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16115685e2aa704ec457ecf3d3c2480bd4387e8445d23ab97c983ba24aeba2b
Instruction ID: 98e8a3af12cc9416dd4cae678cbecc0a8591e12be884397bcf26d3e8a108107d
Opcode Fuzzy Hash: b16115685e2aa704ec457ecf3d3c2480bd4387e8445d23ab97c983ba24aeba2b
Instruction Fuzzy Hash: 82F0B4B29176909FE737C71CC004B3AFFD49B05670F7484A7D51587242D7A4D880C2D1

Uniqueness

Uniqueness Score: -1.00%

Function 017E2073 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E017E2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E017DFD22(__ecx);
				_t19 =  *0x181849c - _t3; // 0x3d6919ef
				if(_t19 == 0) {
					__eflags = _t17 -  *0x1818748; // 0x0
					if(__eflags <= 0) {
						E017E1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x1818724 & 0x00000004;
							if(( *0x1818724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x1818724; // 0x0
					return E017D8DF1(__ebx, 0xc0000374, 0x1815890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x017e2076
0x017e2078
0x017e207d
0x017e2083
0x017e20a4
0x017e20aa
0x017e20ac
0x017e20b7
0x017e20ba
0x017e20bc
0x017e20c9
0x017e20c9
0x017e20d0
0x017e20d2
0x00000000
0x017e20d2
0x017e20be
0x017e20c3
0x017e20c5
0x017e20c7
0x00000000
0x00000000
0x017e20c7
0x017e20bc
0x017e20d4
0x017e2085
0x017e2085
0x017e20a3
0x017e20a3

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65bec86a6a65b7840b7ddc208410f196984558abcf9df1a914dab4a50baa7ad5
Instruction ID: cb90e6e35c00a7ba0c3c5268cdd862416582bda5db647f6a8e9c874cef14b1ce
Opcode Fuzzy Hash: 65bec86a6a65b7840b7ddc208410f196984558abcf9df1a914dab4a50baa7ad5
Instruction Fuzzy Hash: 6DF0A06B8151894BDF326B28655A2E2AFEED79E110B490885D9A05728EC9348A93CF24

Uniqueness

Uniqueness Score: -1.00%

Function 0176927A Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0176927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E0176FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E017692C6(_t11, _t14);
				}
				return _t11;
			}

0x01769295
0x01769299
0x0176929f
0x017692aa
0x017692ad
0x017692ae
0x017692af
0x017692b0
0x017692b4
0x017692bb
0x017692bb
0x017692c5

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 5e74743c6da3ad96e865173dd58b3c038556f1bc34ebc3ddb6245d0f52ce0c4e
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 8CE02B323405016FE7119E09DCC4F17B75DEF92724F004078FA001E242C6F5DD0887A0

Uniqueness

Uniqueness Score: -1.00%

Function 017F8D34 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E017F8D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x181d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E01747D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E0176B640(E01769AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x017f8d34
0x017f8d43
0x017f8d4b
0x017f8d4e
0x017f8d52
0x017f8d5c
0x017f8d6e
0x017f8d5e
0x017f8d67
0x017f8d67
0x017f8d79
0x017f8d7a
0x017f8d7c
0x017f8d81
0x017f8d94

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07504d858838fc33ed98a2076f05799c6b3b03cb3f39f64cbfb7f6728bda497f
Instruction ID: eb90ff2f47e204f11104b947f49d2b44c73478affd27dace64db70cf098d81bd
Opcode Fuzzy Hash: 07504d858838fc33ed98a2076f05799c6b3b03cb3f39f64cbfb7f6728bda497f
Instruction Fuzzy Hash: D5F0B470A046089FDB14EFB8D445B6EF7B8EF18300F508099EA05EB380EA34DA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 017F8B58 Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E017F8B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x181d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E01747D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0176B640(E01769AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x017f8b67
0x017f8b6f
0x017f8b72
0x017f8b7d
0x017f8b8f
0x017f8b7f
0x017f8b88
0x017f8b88
0x017f8b9a
0x017f8b9b
0x017f8b9d
0x017f8ba2
0x017f8bb5

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed4027311e5170e325add83085bff3670b568bb25f2727b03761def6adbe49f
Instruction ID: 18de5d9333053d7132f5bc42046d03cb8a234284033ee95c5828a5422dfcf7ff
Opcode Fuzzy Hash: 9ed4027311e5170e325add83085bff3670b568bb25f2727b03761def6adbe49f
Instruction Fuzzy Hash: 86F082B1A1425DAFDB14EBA8D90AE6FF7B8EF14300F440499BA05DB380EB34DA00C795

Uniqueness

Uniqueness Score: -1.00%

Function 0174746D Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0174746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0173EB70(__ecx, 0x18179a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E017695D0();
							L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0174746d
0x0174746d
0x0174746d
0x01747471
0x01747488
0x0178f92d
0x0174748e
0x01747491
0x01747495
0x0178f937
0x0178f93a
0x0178f94e
0x0178f953
0x0178f956
0x0178f956
0x01747495
0x00000000
0x01747488
0x01747473
0x01747478
0x0174747d
0x01747481
0x00000000
0x01747481
0x0174747d
0x0174747a
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2f4ecec6e30eb19e08c9ef4decca8ece502a8490108779cb9a8f9173f951fa
Instruction ID: f9d191ed17cfa33339e1d103d490592d619759502107384148331c0c30b8627d
Opcode Fuzzy Hash: 7d2f4ecec6e30eb19e08c9ef4decca8ece502a8490108779cb9a8f9173f951fa
Instruction Fuzzy Hash: F8F0E238940145ABDF1AAB6CC840F79FFB1AF04314F1506A9D961AF1A6E728D800C785

Uniqueness

Uniqueness Score: -1.00%

Function 017F8CD6 Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E017F8CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x181d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E01747D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0176B640(E01769AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x017f8ce5
0x017f8ced
0x017f8cf0
0x017f8cfb
0x017f8d0d
0x017f8cfd
0x017f8d06
0x017f8d06
0x017f8d18
0x017f8d19
0x017f8d1b
0x017f8d20
0x017f8d33

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8130952ba56745c330e6eec20605cd30492d420a7bef430cd493314baa3d2d85
Instruction ID: 3bd9da99fe0f0ba7b9af2734718e3ab69e332b5ce138b7aa4f1655d88785c861
Opcode Fuzzy Hash: 8130952ba56745c330e6eec20605cd30492d420a7bef430cd493314baa3d2d85
Instruction Fuzzy Hash: 62F08271A04609AFDB04DBB8E949E6EF7B8EF19300F500199EA15EB3C4EA34DA40CB55

Uniqueness

Uniqueness Score: -1.00%

Function 01724F2E Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01724F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E017F88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0174C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x1701030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x01724f2e
0x01724f34
0x01724f38
0x01780b85
0x01780b85
0x01780b89
0x01780b9a
0x01780b9a
0x01780b9f
0x00000000
0x01780b9f
0x01780b94
0x01780b98
0x00000000
0x00000000
0x00000000
0x01780b98
0x01724f3e
0x01724f48
0x00000000
0x01724f6e
0x00000000
0x01724f70

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79fe10db7441496e11eac9c2615f6f676f53701ba0709f8c57e1a18c14aedb5c
Instruction ID: 84463e69ba7813156d01777037f04bdd45ac7d04520346757672f1588a74f52e
Opcode Fuzzy Hash: 79fe10db7441496e11eac9c2615f6f676f53701ba0709f8c57e1a18c14aedb5c
Instruction Fuzzy Hash: 11F0E2325A66948FE772EB1CC944B22FFD8AB007B8F544478F41587A26C724EC48C680

Uniqueness

Uniqueness Score: -1.00%

Function 0175A44B Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0175A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x1817b9c; // 0x0
				_t15 = __ecx;
				_t16 = L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E0176FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x0175a44b
0x0175a453
0x0175a472
0x0175a476
0x00000000
0x0175a493
0x0175a47a
0x0175a47f
0x0175a486
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd5e7145ff43f360eb907221805b162c7d3da3ca66c4a6707b0f1b76a30f225
Instruction ID: 1d716f1c8c2ca703caee7bf72e5921bd224e515800efc4bc46609e6b2ea76505
Opcode Fuzzy Hash: cdd5e7145ff43f360eb907221805b162c7d3da3ca66c4a6707b0f1b76a30f225
Instruction Fuzzy Hash: 61E092B2A01421ABD3215A58BC00F66B79DEBE5A51F094139FA05D7214D678DE01C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0172F358 Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0172F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0175F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L01744620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x0172f35d
0x0172f361
0x0172f367
0x0172f372
0x0172f38c
0x0172f38c
0x0172f394

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: aa311fb167e71ba264c61831a58b2039f137a8d4e043b7408fee1367271a3e97
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 17E0DF32A40128FBDB61AAD99E09FAAFFBCEB58AA0F000196FA04D7151D5709E00D2D1

Uniqueness

Uniqueness Score: -1.00%

Function 0173FF60 Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0173FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x17011a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E017F88F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E01740050(_t14);
				}
			}

0x0173ff66
0x0173ff6b
0x00000000
0x0173ff8f
0x00000000
0x0173ff8f

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd679f1cc992e537ba16ab96421e1b340964b0ce722da6e31077e0e3bb6a9c37
Instruction ID: b8e302eb2054b22a3c28f5f3fb229120353dce1cad2f931272838154606e722e
Opcode Fuzzy Hash: bd679f1cc992e537ba16ab96421e1b340964b0ce722da6e31077e0e3bb6a9c37
Instruction Fuzzy Hash: 9EE0DFB0A09206DFD73ADB59D044F27FB989B927A1F1A805DE8084B103C621D880C287

Uniqueness

Uniqueness Score: -1.00%

Function 017B41E8 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E017B41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x18008f0);
				_t5 = E0177D08C(__ebx, __edi, __esi);
				if( *0x18187ec == 0) {
					E0173EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x18187ec == 0) {
						 *0x18187f0 = 0x18187ec;
						 *0x18187ec = 0x18187ec;
						 *0x18187e8 = 0x18187e4;
						 *0x18187e4 = 0x18187e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L017B4248();
				}
				return E0177D0D1(_t5);
			}

0x017b41e8
0x017b41ea
0x017b41ef
0x017b41fb
0x017b4206
0x017b420b
0x017b4216
0x017b421d
0x017b4222
0x017b422c
0x017b4231
0x017b4231
0x017b4236
0x017b423d
0x017b423d
0x017b4247

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3dd442b2aa1adfc012d0a396c5570788d01c5c8ebc1383246117b76fecb556
Instruction ID: af71ac2ad6f3b19a56a4ca458f9d4bd7ee250a581552aede7e26416edacf369b
Opcode Fuzzy Hash: dd3dd442b2aa1adfc012d0a396c5570788d01c5c8ebc1383246117b76fecb556
Instruction Fuzzy Hash: A9F03976851705CFCBB2EFA9D54AB94B6B8FB56311F00492A92028728EC73447A5DF11

Uniqueness

Uniqueness Score: -1.00%

Function 017DD380 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017DD380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0172E8B0(__ecx, _a4, 0xfff);
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x017dd38a
0x017dd39b
0x017dd3b1
0x00000000
0x017dd3b6
0x00000000

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 44a4b249c13a2ca95a16acc9264b3b75bc1807cfdf12836957e46321f9e3d2e2
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 4AE0C231280219FBDB325E84CC00F69FB26EB507A0F104031FE489A6D0CA719C91D6C4

Uniqueness

Uniqueness Score: -1.00%

Function 0175A185 Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0175A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x18167e4 >= 0xa) {
					if(_t5 < 0x1816800 || _t5 >= 0x1816900) {
						return L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E01740010(0x18167e0, _t5);
				}
			}

0x0175a190
0x0175a1a6
0x0175a1c2
0x00000000
0x00000000
0x00000000
0x0175a192
0x0175a192
0x0175a19f
0x0175a19f

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700f52823ab6a4eaabaae5d3819156b44a5ae03e1dd18645143438cadc591d89
Instruction ID: 3695ee78a56a961679074eea8560f26c8b622b1159b302f5b8f97700220a7632
Opcode Fuzzy Hash: 700f52823ab6a4eaabaae5d3819156b44a5ae03e1dd18645143438cadc591d89
Instruction Fuzzy Hash: 37D017625610005BC72E67209958F25B62AF784760F344A2DE7868B9AAFAE089D9D248

Uniqueness

Uniqueness Score: -1.00%

Function 017516E0 Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017516E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E01751710(0x18167e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L01744620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x017516e8
0x017516ef
0x017516f3
0x017516fe
0x00000000
0x01751700
0x0175170d
0x0175170d
0x017516f2
0x017516f2
0x017516f2
0x017516f2

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6867ac9303838537325a1a6ada62f247a75d930f045cc2ef587875eb48945a
Instruction ID: b63dd67a36599e3deeaff17003cee0964b57f3b23e9ff31e3cfd853dddd4c52c
Opcode Fuzzy Hash: cf6867ac9303838537325a1a6ada62f247a75d930f045cc2ef587875eb48945a
Instruction Fuzzy Hash: B8D0A73114010192EB2D5B189808F146655EB90782F78045CF707494C4DFF0CD93E458

Uniqueness

Uniqueness Score: -1.00%

Function 017A53CA Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017A53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E0173EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x017a53ca
0x017a53ce
0x017a53d9
0x017a53de
0x017a53e1
0x017a53e1
0x017a53e6
0x017a53f3
0x00000000
0x017a53f8
0x017a53fb

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 89d73358931b9668d557b1d9a8fda06fef2f6d8aba6748b0150c63cd1aea4f48
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: A5E04D32A00680ABCF16EB88CA94F4AFBF9BB84B00F180418A5086B621CA24A800CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0173AAB0 Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0173AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x0173aab6
0x0173aabb
0x0178a442
0x00000000
0x0178a448
0x0178a454
0x0178a454
0x0173aac1
0x0173aac1
0x0173aac6
0x0173aac6

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 151baf1725fc986ec8f4eb23feeb9ea33e6462b8f259b3a0aaf50da07c0f9fd5
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: A0D0C935352980CFD617CB0CC554B0573A4FB44B80FC50490E540CB722E62CD940CA00

Uniqueness

Uniqueness Score: -1.00%

Function 017535A1 Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017535A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0173EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x017535a1
0x017535a1
0x017535a5
0x017535ab
0x017535ab
0x017535b5
0x00000000
0x017535c1
0x017535b7

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: f5ae003156ede3c5b0792361b5e6f4d1adecd9f37019637ddad6703b01fcc637
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 72D0A73140118199DB82AB34C138768F771BF0038CF783065880305476C3B54D09C600

Uniqueness

Uniqueness Score: -1.00%

Function 0172DB40 Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0172DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L01744620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x0172db4d
0x0172db54
0x0172db5f
0x0172db56
0x0172db56
0x0172db5c
0x0172db5c

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 1666e1bf8b6251cc3c1fec18ed57d6ea3d0486ec68f208a1dc14c50445425954
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 22C08C30280A01ABEB322F20CD01B00BAA0BB10B01F4400A0A301DA0F0DB78DC02E600

Uniqueness

Uniqueness Score: -1.00%

Function 017AA537 Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017AA537(intOrPtr _a4, intOrPtr _a8) {

				return L01748E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x017aa553

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 3173438b612f8569e25964049dc34acb5ca0a2b23c12f9e71ee23f8a749b673b
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: B0C01232080248BBCB226E81CC00F06BB2AEBA8B60F008010BA080A5608632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 01743A1C Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01743A1C(intOrPtr _a4) {
				void* _t5;

				return L01744620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x01743a35

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 2a8c3a860d008d24fd7f8874183f3fd79ab3868bd4a263ffdef057059e515716
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: E7C08C32080248BBC7126E41DC00F01BB29E7A0B60F000020B6040A5608632EC60E589

Uniqueness

Uniqueness Score: -1.00%

Function 0172AD30 Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0172AD30(intOrPtr _a4) {

				return L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x0172ad49

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 61eb30381277c972c461a283e258b520572f5f3afd259cfa46e6bccda325f854
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: F7C08C32080248BBC712AA45CD00F01BB29E7A0B60F000020F6040A6618A32E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 017376E2 Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017376E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L017477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x017376e4
0x00000000
0x017376f8
0x017376fd

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 8eb2a8b03616966a60603065862d8343d0de5bebcdddb97d3aae9c92c3dc5b82
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: B0C08CB01421809BEB2F970CCE34B20BA50AB48708F88019CEB01294A3C368A802D208

Uniqueness

Uniqueness Score: -1.00%

Function 017536CC Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E017536CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L01744620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x017536d2
0x017536e8
0x017536d4
0x017536e5
0x017536e5

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 666fed16bc1f2309afab246f95f94d0d7386949e52cbae8cb27ddafce72cd994
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 27C02B70150440FBD7152F30CD00F15F254F700B61F64035C7221454F0D6799C00F101

Uniqueness

Uniqueness Score: -1.00%

Function 01747D50 Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01747D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x01747d56
0x01747d5b
0x01747d60
0x01747d5d
0x01747d5d
0x01747d5d

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 297d6dcd97cf2939d3a23e16cc97b2258035159ec9bd4838c7f4b847c85a5583
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 81B092353119408FCE1ADF28C080B1573E4BB44A40B8500D0E400CBA21D329E8408900

Uniqueness

Uniqueness Score: -1.00%

Function 01752ACB Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01752ACB() {
				void* _t5;

				return E0173EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x01752adc

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: e98c4aa162961c9b2c03216e1a07c9048b1000906d88fc41a1bac3ad05803636
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: BDB01232C10441CFCF07EF44C610F19B331FF40750F0544A0900127931C628EC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01769950 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f001ef47f7b6ad0ece209d1553cbdf9929b80ac08c0851b412f2072e85d28142
Instruction ID: 2a7ae217d0d0b272b97e3db00cd5db4398ebf08294099ba41a6c9c9c9edc10f0
Opcode Fuzzy Hash: f001ef47f7b6ad0ece209d1553cbdf9929b80ac08c0851b412f2072e85d28142
Instruction Fuzzy Hash: A19002A120540407E550659988046074005ABD4342F51C021A2055555ECA698C517175

Uniqueness

Uniqueness Score: -1.00%

Function 017699D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ac3b911cd36b14f24e2584decf00431518a22069893187ad162728f7ecb8a7
Instruction ID: 565752c7e1bc24a75ad63db97097b44aa33c05354e16ef65ecfe18092db15374
Opcode Fuzzy Hash: 82ac3b911cd36b14f24e2584decf00431518a22069893187ad162728f7ecb8a7
Instruction Fuzzy Hash: B89002A121500046E514619984047064045ABE5241F51C022A2145554CC5698C617165

Uniqueness

Uniqueness Score: -1.00%

Function 0176B040 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32106e3eaf4681c758237825f6b97434df571dc285d3b038f94110d20865272c
Instruction ID: 741e359f3c76e86d2d8e5968075d7650650716dc4f8ddf69e52906a50538d6cf
Opcode Fuzzy Hash: 32106e3eaf4681c758237825f6b97434df571dc285d3b038f94110d20865272c
Instruction Fuzzy Hash: 959002A1605140475950B19988044069015BBE5341791C131A0445560CC6A88855B2A5

Uniqueness

Uniqueness Score: -1.00%

Function 01769820 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dafa047c4d8c1fd0493f83a91fb948ac9d61fba7b83760bcd2884db7d4a4763
Instruction ID: a131523d84339b8c12c5b8089cc79a332a2a7ae7b133f1dc6061dfcc792bf7cb
Opcode Fuzzy Hash: 7dafa047c4d8c1fd0493f83a91fb948ac9d61fba7b83760bcd2884db7d4a4763
Instruction Fuzzy Hash: 2E90027124500406E551719984046064009BBD4281F91C022A0415554EC6958A56BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 017698A0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb06a5bca76ea56a24b406fc85f8a979f7306b3143b43673edad7d6af96d7a3
Instruction ID: df40499952f58a9db9dded6c79ddda9720a70042305c1d172b57fea8103f6ab2
Opcode Fuzzy Hash: 7bb06a5bca76ea56a24b406fc85f8a979f7306b3143b43673edad7d6af96d7a3
Instruction Fuzzy Hash: 0990026130500406E512619984146064009EBD5385F91C022E1415555DC6658953B172

Uniqueness

Uniqueness Score: -1.00%

Function 01769B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5e662de30ce381388d53d82132cbebd3b78c12d66225e619e80a072ef1531f
Instruction ID: 0f5573c07211ad5a3f35cbe483ec7adb61b7198ecc87ca3f7c92a2528673322b
Opcode Fuzzy Hash: 1f5e662de30ce381388d53d82132cbebd3b78c12d66225e619e80a072ef1531f
Instruction Fuzzy Hash: AD90026124500806E5507199C4147074006EBD4641F51C021A0015554DC656896576F1

Uniqueness

Uniqueness Score: -1.00%

Function 0176A3B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c3517a112b817d3746f976bd7361e5016f017357859ac69f7ae7a5a52fd7e8
Instruction ID: 6a3ae8f6d07b9a91654fef7168306a1e39b77c5b48d892d1e30409f7a42177f8
Opcode Fuzzy Hash: f0c3517a112b817d3746f976bd7361e5016f017357859ac69f7ae7a5a52fd7e8
Instruction Fuzzy Hash: AB90027120544006E5507199C44460B9005BBE4341F51C421E0416554CC6558856B261

Uniqueness

Uniqueness Score: -1.00%

Function 01769A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48274458971ee1eb1f92c8dbaa16be5126ee90b78c44db562df4421d2311e07a
Instruction ID: 5d99a514e7855cb9debda24309382c666b6f1e624232118e3e9da74c6fbb9226
Opcode Fuzzy Hash: 48274458971ee1eb1f92c8dbaa16be5126ee90b78c44db562df4421d2311e07a
Instruction Fuzzy Hash: 3C90027120540406E510619988087474005ABD4342F51C021A5155555EC6A5C8917571

Uniqueness

Uniqueness Score: -1.00%

Function 01769A80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22387794dce52dd04d89ed385b289bc1e27cf72381b8a064b1644f78f5a01cab
Instruction ID: 856ce615fc18c1f45661e323b0735da9626e843524b46d722ded8109b8557696
Opcode Fuzzy Hash: 22387794dce52dd04d89ed385b289bc1e27cf72381b8a064b1644f78f5a01cab
Instruction Fuzzy Hash: 7B90026120544446E55062998804B0F8105ABE5242F91C029A4147554CC95588557761

Uniqueness

Uniqueness Score: -1.00%

Function 01769560 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f16591124cc03a6a8eb0f1e8bba4cba60243057ce826031847a3c19dcd1884
Instruction ID: a3eb0b467d83d0d3e52ebe34256deb6fe620c6ea23afac7cd35cede65d5d3f4f
Opcode Fuzzy Hash: d9f16591124cc03a6a8eb0f1e8bba4cba60243057ce826031847a3c19dcd1884
Instruction Fuzzy Hash: BC900265225000061555A599460450B4445BBDA391791C025F1407590CC66188657361

Uniqueness

Uniqueness Score: -1.00%

Function 0176AD30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6be2e220e93c7a066f6dac5a19961b9de1cfeb5ea46d6bd751c4695e37c0b66
Instruction ID: f0ab6b1391648f65ce4af345cd3897e753fd7dbb988d0ef50b7240dfc718b1d2
Opcode Fuzzy Hash: f6be2e220e93c7a066f6dac5a19961b9de1cfeb5ea46d6bd751c4695e37c0b66
Instruction Fuzzy Hash: FC900271A0900016A550719988146468006BBE4781F55C021A0505554CC9948A5573E1

Uniqueness

Uniqueness Score: -1.00%

Function 01769520 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8b9a63c6d7c63643c5dc03583e6db347458fd750d2341f3b60ae3d6121767e
Instruction ID: 50617817ddee61f3dd27fd3e6ca99cfa06f9c3bc414b0c4cb156006f69259eb9
Opcode Fuzzy Hash: 9e8b9a63c6d7c63643c5dc03583e6db347458fd750d2341f3b60ae3d6121767e
Instruction Fuzzy Hash: 149002E1205140965910A299C404B0A8505ABE4241F51C026E1045560CC5658851B175

Uniqueness

Uniqueness Score: -1.00%

Function 017695F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a610ea9c6a7327484684baadd5b5b09e69f3ad3d6c39aa26256a7ae880fb690e
Instruction ID: 95821a727851e20e3bc8b204cbfe1334a4703e634df2f597840bb971ad1b99c8
Opcode Fuzzy Hash: a610ea9c6a7327484684baadd5b5b09e69f3ad3d6c39aa26256a7ae880fb690e
Instruction Fuzzy Hash: DA90027120500806E514619988046864005ABD4341F51C021A6015655ED6A588917171

Uniqueness

Uniqueness Score: -1.00%

Function 0176A770 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a32a84b6229806deb16652093b26c61d1657f326f9c572fd858d054a3ea126
Instruction ID: c4dfe172e99a010416091a65494120ebfe2929c7a36cd4b13359495bc0249efb
Opcode Fuzzy Hash: 96a32a84b6229806deb16652093b26c61d1657f326f9c572fd858d054a3ea126
Instruction Fuzzy Hash: FB90027520904446E91065999804A874005ABD4345F51D421A041559CDC6948861B161

Uniqueness

Uniqueness Score: -1.00%

Function 01769770 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72cb30b352f55134d76dd6fa40cb44c59c239352b69fe576cbbd6edb0336f78
Instruction ID: e90d0c881147ed1c06ae124df63509ad1e6c0b120d52879d157cdad97d18596e
Opcode Fuzzy Hash: c72cb30b352f55134d76dd6fa40cb44c59c239352b69fe576cbbd6edb0336f78
Instruction Fuzzy Hash: BD90026120904446E51065999408A064005ABD4245F51D021A1055595DC6758851B171

Uniqueness

Uniqueness Score: -1.00%

Function 01769760 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c6f9f44cf1cb0f18b82444d905b9a94df81b1c9afb76b1e8cd55e4841f071
Instruction ID: 46702bf04f82e2e28e96f42de3fb0160a1bcb09d1470db94474b5a57ab6093d7
Opcode Fuzzy Hash: 8f0c6f9f44cf1cb0f18b82444d905b9a94df81b1c9afb76b1e8cd55e4841f071
Instruction Fuzzy Hash: ED90027120500407E510619995087074005ABD4241F51D421A0415558DD69688517161

Uniqueness

Uniqueness Score: -1.00%

Function 01769730 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03dcb8b06fca777a6743e333f2b3d3fa7512f63ccadf60f5bc7f93da81dfacee
Instruction ID: 30fb2eace7f4cf6142a267b3531a24e42639a98358db530e391dc849ce90568c
Opcode Fuzzy Hash: 03dcb8b06fca777a6743e333f2b3d3fa7512f63ccadf60f5bc7f93da81dfacee
Instruction Fuzzy Hash: F090026160900406E550719994187064015ABD4241F51D021A0015554DC6998A5576E1

Uniqueness

Uniqueness Score: -1.00%

Function 0176A710 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd30ab33703a9b8f217695deb60abedd150db332a8593a80456716444953d88
Instruction ID: 350a7a18a00c64ae8a59aeaae8f1f6244fd99d5d444d05d75ec942c76e9c3746
Opcode Fuzzy Hash: acd30ab33703a9b8f217695deb60abedd150db332a8593a80456716444953d88
Instruction Fuzzy Hash: 1690027130500056A910A6D99804A4A8105ABF4341F51D025A4005554CC59488617161

Uniqueness

Uniqueness Score: -1.00%

Function 01769650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13dadd90e81f1a5b9381a9c3976bc684a0a8a1ae8e63c00ac4134186d562d073
Instruction ID: 6500662cef721d64f7188c08a72c945c0f32f796c5a225761478c274069252a9
Opcode Fuzzy Hash: 13dadd90e81f1a5b9381a9c3976bc684a0a8a1ae8e63c00ac4134186d562d073
Instruction Fuzzy Hash: 4290027120904846E55071998404A464015ABD4345F51C021A0055694DD6658D55B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 01769610 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac587b1b1edb02d8b5c3bc384b490e5be005fd663d668553834a8370817ec530
Instruction ID: 0425d861ad7afac8661453c9db27e1151c489d7e47f34a2fdc9f0c74919ef7fa
Opcode Fuzzy Hash: ac587b1b1edb02d8b5c3bc384b490e5be005fd663d668553834a8370817ec530
Instruction Fuzzy Hash: 1E90027160900806E560719984147464005ABD4341F51C021A0015654DC7958A5576E1

Uniqueness

Uniqueness Score: -1.00%

Function 017696D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fca71de72ef587d6c868bcc65ca72f9bd81f6a0eb6f784bf1dfbedac5282458
Instruction ID: 64cc7d5746bbb605b73ea16ec881ac2bc2ee226b06ddf643bd36a40d4271f57e
Opcode Fuzzy Hash: 9fca71de72ef587d6c868bcc65ca72f9bd81f6a0eb6f784bf1dfbedac5282458
Instruction Fuzzy Hash: 8590027120500846E51061998404B464005ABE4341F51C026A0115654DC655C8517561

Uniqueness

Uniqueness Score: -1.00%

Function 01769670 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 6f8e77ff46e74d5a432d46be51dc3c1bfc748be5a391cab515628a28b24cf70f
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0175645B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E0175645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x181d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E0176FA60( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E01742280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E0173FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x181b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E0176B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x0175645b
0x01756463
0x0175646d
0x01756475
0x0175647a
0x0175647e
0x01756480
0x0175648c
0x01756490
0x01756495
0x01756498
0x0175649b
0x0175649f
0x017564a1
0x01797c07
0x01797c09
0x01797c0c
0x00000000
0x017564a7
0x017564a7
0x017564aa
0x01797bf7
0x01797c00
0x00000000
0x01797bf9
0x01797bf9
0x01797bf9
0x017564b0
0x017564b0
0x017564b2
0x017564b2
0x017564b3
0x017564ba
0x01756553
0x0175655e
0x01756566
0x0175656c
0x01756575
0x0175657f
0x01756585
0x01756588
0x01756588
0x017564c7
0x017564cb
0x017564ce
0x017564d3
0x017564da
0x017564e5
0x017564ed
0x017564f1
0x017564f5
0x017564f6
0x017564fa
0x01756502
0x01756503
0x01756504
0x01756507
0x0175651a
0x01756524
0x01756524
0x01756526
0x01756526
0x017564aa
0x0175652c
0x0175652d
0x0175652e
0x01756539

APIs

RtlDebugPrintTimes.NTDLL ref: 0175651A

Strings

0, xrefs: 017564E5
0, xrefs: 017564FA

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: 59c80b4b77543ee1e11db02f52c8a72adcf0ddf66d66b85765fa69d1b501e0da
Instruction ID: 24238073afb39ae3e7518038f337a7068809f8d777677c976dbad4ee09a10c8a
Opcode Fuzzy Hash: 59c80b4b77543ee1e11db02f52c8a72adcf0ddf66d66b85765fa69d1b501e0da
Instruction Fuzzy Hash: 16416BB16087069FD751CF28D444A2AFBE5BB89708F04466EF988DB301D771EA09CF86

Uniqueness

Uniqueness Score: -1.00%

Function 017BFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E017BFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0176CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E017B5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E017B5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x017bfdda
0x017bfde2
0x017bfde5
0x017bfdec
0x017bfdfa
0x017bfdff
0x017bfe0a
0x017bfe0f
0x017bfe17
0x017bfe1e
0x017bfe19
0x017bfe19
0x017bfe19
0x017bfe20
0x017bfe21
0x017bfe22
0x017bfe25
0x017bfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 017BFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 017BFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 017BFE2B

Memory Dump Source

Source File: 00000008.00000002.427705034.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: true

Associated: 00000008.00000002.430047936.000000000181B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.430066355.000000000181F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_SwiftMessage_Unlocked_Transaction ProofMessage.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: a9566037adcc257faa5391722078703ef16db00644223500bcdc917164fefd32
Instruction ID: e9fdfa603b4bea4ba139aa608db55b964708625fd4f66f8eabb6fae545bcd290
Opcode Fuzzy Hash: a9566037adcc257faa5391722078703ef16db00644223500bcdc917164fefd32
Instruction Fuzzy Hash: 08F0C272200601BBE7211E49DC46F63FB6AEB45B30F240218F628561E1EA62B83086A4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cmd.exePID: 2896, Parent PID: 3616COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	639
Total number of Limit Nodes:	77

Executed Functions

Function 005EB7D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(005E6770,E888802B,FFFFFFFF,005E6424,00000206,?,pg^,00000206,005E6424,FFFFFFFF,E888802B,005E6770,00000206,00000000), ref: 005EB815

Strings

pg^, xrefs: 005EB7F2, 005EB800

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: pg^
API String ID: 2738559852-232730833
Opcode ID: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
Instruction ID: 741195bb2aa8585c92c0e56c7a31ac45315efb8096889860ad0e970298d87531
Opcode Fuzzy Hash: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
Instruction Fuzzy Hash: 1EF0A4B2200108ABCB14DF89DC85EEB77ADAF8C754F118648BA5D97241D630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005EB7CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(005E6770,E888802B,FFFFFFFF,005E6424,00000206,?,pg^,00000206,005E6424,FFFFFFFF,E888802B,005E6770,00000206,00000000), ref: 005EB815

Strings

pg^, xrefs: 005EB7F2, 005EB800

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: pg^
API String ID: 2738559852-232730833
Opcode ID: 76eb982f00523035bbb52e755e0a3705d76d7e270bb7c57e0fbad4c331308984
Instruction ID: 024a29d5d104410d3c48f87f8111f6b0cba81273dd45a4ce938919050c4d2b27
Opcode Fuzzy Hash: 76eb982f00523035bbb52e755e0a3705d76d7e270bb7c57e0fbad4c331308984
Instruction Fuzzy Hash: 58F0F9B2210045AFCB08DF98DC84CEBBBADEF8C214B058658B95997205D630E851CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 005EB71A Relevance: 1.5, APIs: 1, Instructions: 41
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,005E65AC,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,005E65AC,00000000,00000005,00000060,00000000,00000000), ref: 005EB76D

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8f64e0d2c7bf48553a1377e546c65f050635ee159b40a22ddb462bd166c25ea3
Instruction ID: e81b5b85a57ef8b1fcdd870c72e42359e8d0454fdd346bd4083a77e322ace4a5
Opcode Fuzzy Hash: 8f64e0d2c7bf48553a1377e546c65f050635ee159b40a22ddb462bd166c25ea3
Instruction Fuzzy Hash: A201ABB6210208ABCB08CF98DC85EEB77E9AF8C754F118648FA0997241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 005EB720 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000005,00000000,005E65AC,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,005E65AC,00000000,00000005,00000060,00000000,00000000), ref: 005EB76D

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
Instruction ID: 8b2c764130b4835bacfc55ea765421e817415ae74deea90fb3153a1c6d7849bb
Opcode Fuzzy Hash: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
Instruction Fuzzy Hash: 2EF0CFB2200208AFCB08CF89DC85EEB37EDAF8C754F018208BA0D97241C630F811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 005D8910 Relevance: 1.5, Strings: 1, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

], xrefs: 005D8AB7

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID: ]
API String ID: 2340568224-3352871620
Opcode ID: 6fd541f6069648ec0de162c2bf9b654148e582267aa09a031e670d0ea3b69a0d
Instruction ID: 0abdc7b56b4ecbd5ae01f3e486f9293f501d51c3e29c62732ea1c2b16aacd265
Opcode Fuzzy Hash: 6fd541f6069648ec0de162c2bf9b654148e582267aa09a031e670d0ea3b69a0d
Instruction Fuzzy Hash: AAA186B1D00209ABDF24DFA8CC46BEF7BB8BF88304F14455BE545A7241EB709B458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 005EB81A Relevance: 1.5, APIs: 1, Instructions: 21filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(005E6572,00000206,?,005E6572,00000005,00000018,?,?,00000000,00000206,?), ref: 005EB845

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: fe2695d30bc1256321b583cdb9b9215c35b1e15fb502fba666927ded24c6fef0
Instruction ID: 735ba8871a0258b85ee5e273e17e8ffe5e0c0a939cef4799357c63e7f2e6a7c3
Opcode Fuzzy Hash: fe2695d30bc1256321b583cdb9b9215c35b1e15fb502fba666927ded24c6fef0
Instruction Fuzzy Hash: 1AE08C32200100ABD710EBA4CC49E977BA9EF88350F258995B91DAF241C230E6018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 005EB850 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(005E674E,00000206,?,005E674E,00000005,FFFFFFFF), ref: 005EB875

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
Instruction ID: ff0beb724b25d4b24b25fffb3a6608146b8eb7e3ad4cfdc7d811161f1d5ff335
Opcode Fuzzy Hash: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
Instruction Fuzzy Hash: B7D01772200214ABD614EBA9DC89E9B7BACEF88660F018555BA5D5B242C630FA008AE0

Uniqueness

Uniqueness Score: -1.00%

Function 005EB820 Relevance: 1.5, APIs: 1, Instructions: 20filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(005E6572,00000206,?,005E6572,00000005,00000018,?,?,00000000,00000206,?), ref: 005EB845

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 126503524c9acbe21b9fd4f7b6543455c439e56fec7c83ecdd5a34c5492c7759
Instruction ID: ab6dd26bdbcd493bff1ad084223e2274882bd0e3281525fd636e44648ea05b98
Opcode Fuzzy Hash: 126503524c9acbe21b9fd4f7b6543455c439e56fec7c83ecdd5a34c5492c7759
Instruction Fuzzy Hash: 21D05E72200214BBD714EF99DC89FD77BACEF88760F118855BA5D5B242C630FA018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 03259A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03259A5A

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 775aa7d98b87ac312b69fd3e70f27c82a342597ca20d6ca30cb5fbdcf955faa8
Instruction ID: e248f9dc69daeb55cd7ab8b946125e57b720a5f41b467f6c0993294c0478a2f3
Opcode Fuzzy Hash: 775aa7d98b87ac312b69fd3e70f27c82a342597ca20d6ca30cb5fbdcf955faa8
Instruction Fuzzy Hash: 8A90026132184C42D200A57A4C14B0700059BD0343F51C115A0144554CCE5588E165A1

Uniqueness

Uniqueness Score: -1.00%

Function 03259910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0325991A

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8e95910e00d6bcd8fba7b43b663c36e5ec013e38a66839557ca60b1960665f5b
Instruction ID: 2b44aaf02e8e53d64648f02d5fc119650fff057498051947b363ea2e8736e449
Opcode Fuzzy Hash: 8e95910e00d6bcd8fba7b43b663c36e5ec013e38a66839557ca60b1960665f5b
Instruction Fuzzy Hash: D59002B131104C02D140B16A440474600059BD0341F51C011A5054554E8B998DD576E5

Uniqueness

Uniqueness Score: -1.00%

Function 032599A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 032599AA

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d01fd252c9d487c567f0f16ab9fa34738d6365452b46a3a04b30b78b554710b6
Instruction ID: 71d47a8aca6fc8347af492d92a1bbd01b8371f5d5c4553df510fd1e8c7ee36d6
Opcode Fuzzy Hash: d01fd252c9d487c567f0f16ab9fa34738d6365452b46a3a04b30b78b554710b6
Instruction Fuzzy Hash: 019002A135104C42D100A16A4414B060005DBE1341F51C015E1054554D8B59CCD271A6

Uniqueness

Uniqueness Score: -1.00%

Function 03259860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0325986A

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 15e3e6dd654ca908ed5971d2f9fdb71ff26fe6332ff5ec7f026ef3474f7ff3db
Instruction ID: b8d4e425fadf61cb86a4b8ea619b0bbe415a69dbd8b0f657336d42ef2e5f02bf
Opcode Fuzzy Hash: 15e3e6dd654ca908ed5971d2f9fdb71ff26fe6332ff5ec7f026ef3474f7ff3db
Instruction Fuzzy Hash: 6D90027131104C13D111A16A450470700099BD0281F91C412A0414558D9B9689D2B1A1

Uniqueness

Uniqueness Score: -1.00%

Function 03259840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0325984A

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3e3a0cc7024367e3abd6d34499c9e2da6badb618c61f56efc7ad354f6cb79b
Instruction ID: 34a203677d10e1fefa680adf9d4dad6b3078872898b9520b5f32a68baca446b5
Opcode Fuzzy Hash: 3f3e3a0cc7024367e3abd6d34499c9e2da6badb618c61f56efc7ad354f6cb79b
Instruction Fuzzy Hash: 3F90026135208D525545F16A44045074006ABE0281791C012A1404950C8A6698D6E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 03259710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0325971A

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 37aafdae071088d4db47b8428762110e888e32d02d10a66e905227a9bc165406
Instruction ID: 7e4582689fa835e2c283a54834cf79cb91ee5fac6f0cf9876b79583eff6d7ee2
Opcode Fuzzy Hash: 37aafdae071088d4db47b8428762110e888e32d02d10a66e905227a9bc165406
Instruction Fuzzy Hash: 3390027131104C02D100A5AA540864600059BE0341F51D011A5014555ECBA588D171B1

Uniqueness

Uniqueness Score: -1.00%

Function 03259780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0325978A

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dba3704537c3d6af4958fdc4e8538e964de0ac111d9d14ae33ef2d7dc85c1316
Instruction ID: b1022f55585afe897cd34ad22cbaa96054e707467c472a066b14092602d615cc
Opcode Fuzzy Hash: dba3704537c3d6af4958fdc4e8538e964de0ac111d9d14ae33ef2d7dc85c1316
Instruction Fuzzy Hash: 7F90026932304C02D180B16A540860A00059BD1242F91D415A0005558CCE5588E963A1

Uniqueness

Uniqueness Score: -1.00%

Function 03259FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03259FEA

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3bb9264c8229056de2feed958b35329086db856b95322584e76bb1ab2962e92e
Instruction ID: a5801f9df0dcfac0dc9c9f168c2a68c3ab1a1cd089c3433fb0624ffcfcaa0413
Opcode Fuzzy Hash: 3bb9264c8229056de2feed958b35329086db856b95322584e76bb1ab2962e92e
Instruction Fuzzy Hash: 2090027132118C02D110A16A840470600059BD1241F51C411A0814558D8BD588D171A2

Uniqueness

Uniqueness Score: -1.00%

Function 032596E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 032596EA

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b24482ebbde105371c4962441370e0d81af42924dfb44ea33a78382785462e4a
Instruction ID: 7ad2bf559051162fa582f860b1237ab5e895fb358cc3d6d9648600feb23423e3
Opcode Fuzzy Hash: b24482ebbde105371c4962441370e0d81af42924dfb44ea33a78382785462e4a
Instruction Fuzzy Hash: FC9002713110CC02D110A16A840474A00059BD0341F55C411A4414658D8BD588D171A1

Uniqueness

Uniqueness Score: -1.00%

Function 032596D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 032596DA

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 293b891ae2ab60cfda1fb687e215b342ff44884e50253c22c7b37281ebc13a4a
Instruction ID: 0631f0d8efae6c8f978e7c208a7c72baa6de72225d1185683c34b3478018c27e
Opcode Fuzzy Hash: 293b891ae2ab60cfda1fb687e215b342ff44884e50253c22c7b37281ebc13a4a
Instruction Fuzzy Hash: 9C90027131104C42D100A16A4404B4600059BE0341F51C016A0114654D8B55C8D175A1

Uniqueness

Uniqueness Score: -1.00%

Function 03259540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0325954A

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 51a288584b2af59da39fbe91536b60ff68d7c432cad924c570d29b458a262d36
Instruction ID: be41861cf2b834e929b738ea87c787423fbad766d843ca1b09bfb7e65ae84ca5
Opcode Fuzzy Hash: 51a288584b2af59da39fbe91536b60ff68d7c432cad924c570d29b458a262d36
Instruction Fuzzy Hash: 4C90026532104C030105E56A070450700469BD5391351C021F1005550CDB6188E161A1

Uniqueness

Uniqueness Score: -1.00%

Function 032595D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 032595DA

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 89a44fae05c726d56b62a08443c14c582dbc75dcca4996e3cd8a55fc451bae0a
Instruction ID: 1ea9217309ef3e9428b3eb001dc501dd3eb0b115c799d66690c9ccd75d84e866
Opcode Fuzzy Hash: 89a44fae05c726d56b62a08443c14c582dbc75dcca4996e3cd8a55fc451bae0a
Instruction Fuzzy Hash: 829002A131204C034105B16A4414616400A9BE0241B51C021E1004590DCA6588D171A5

Uniqueness

Uniqueness Score: -1.00%

Function 005D890F Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

], xrefs: 005D89C8

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID: ]
API String ID: 2340568224-3352871620
Opcode ID: 902fdd8743a0aa8fcb2c9977d30edc8b435b693c514516ce64461f83d7d2e189
Instruction ID: 62abc7034941a8f4af5b365d0ee48bee0271af1777fbb114ce410626ccbb2490
Opcode Fuzzy Hash: 902fdd8743a0aa8fcb2c9977d30edc8b435b693c514516ce64461f83d7d2e189
Instruction Fuzzy Hash: BF71BAB1D0020AAADB34EB64CC46FEE7B78BF88304F10455FF555A7241EB70AB458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 005EA400 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 005EA4A8

Strings

net.dll, xrefs: 005EA471, 005EA4F7, 005EA4CF, 005EA4DB, 005EA503
wininet.dll, xrefs: 005EA45E, 005EA467

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: dab99f795a4197943199d41c9f49a962d6916e61ef35bab235633d856db032fa
Instruction ID: b229df255d3758f5bcea20371f526873bc3db5371267a2b2a256d3226fe77e28
Opcode Fuzzy Hash: dab99f795a4197943199d41c9f49a962d6916e61ef35bab235633d856db032fa
Instruction Fuzzy Hash: 1231D2B1601701ABC729DFA5C8A5FA7BBF8FB88300F10851EFA595B641D370B945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005EA3F4 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 82
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 005EA4A8

Strings

net.dll, xrefs: 005EA471, 005EA4CF, 005EA4DB
wininet.dll, xrefs: 005EA45E, 005EA467

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 331ca7cea626102901f366a6a59ab137a1e040fbe42209bc96b49e780825c325
Instruction ID: 54184fd02560525f6471f7ea7e69ffd5daa97eefc10c38802131aed9cc841fa3
Opcode Fuzzy Hash: 331ca7cea626102901f366a6a59ab137a1e040fbe42209bc96b49e780825c325
Instruction Fuzzy Hash: 6631B1B1A01701ABCB24DF75C8D5FABBBB4FB98700F108519FA495B685E370A944CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005D76E0 Relevance: 3.1, APIs: 2, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 005D773A
PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 005D775B

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 37eda513e28b141134352aaae117c984a63d0a4a4c21632bc3138b04dc9b2757
Instruction ID: da0d8597641865f3997b42c2b9748ee8f045d02c347fc182d8df0325ec99c8e1
Opcode Fuzzy Hash: 37eda513e28b141134352aaae117c984a63d0a4a4c21632bc3138b04dc9b2757
Instruction Fuzzy Hash: AF01F231A8022977E730A6948C43FBE7B6CAB84B50F04041AFF04BA2C1E694690643F6

Uniqueness

Uniqueness Score: -1.00%

Function 005EA523 Relevance: 1.6, APIs: 1, Instructions: 108
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,FF74412D,00000000,00000000,?,?,?,FF74412D,?), ref: 005EA56C

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f581358dd337ebddd2e2d8a1924252f8f79df48d991ed31745ead3c6f05e1142
Instruction ID: e1691c41bb2d8df32ad51e21c605e594da3a91ff5baa1caef0eca6162a0b210e
Opcode Fuzzy Hash: f581358dd337ebddd2e2d8a1924252f8f79df48d991ed31745ead3c6f05e1142
Instruction Fuzzy Hash: 4231F3727017416BD729DB74CCA1FEBB7ACBB88304F04451AFA5E8B181D774B9098B61

Uniqueness

Uniqueness Score: -1.00%

Function 005DAC20 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 005DAC92

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 315ed88b4578996a59fd98d6ab37272118d8e22c4bced4730141ce230a46c29b
Instruction ID: 5ebf36652c1976c180ac2ccd69250990a805d9a44c13b35b5deb9815aedab701
Opcode Fuzzy Hash: 315ed88b4578996a59fd98d6ab37272118d8e22c4bced4730141ce230a46c29b
Instruction Fuzzy Hash: 900171B5E1020EABDF14DBE5DC46F9EBB78AB54308F004595F90897251F631EB04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005DE7D1 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008003,?,005D892A,?), ref: 005DE7CB

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 255411c787cb7bf9a68f61edd8ce72405398ba63b8d21158fe6b48fda8096d73
Instruction ID: 9cb77e092daeaa25bc251282389b7262f38d2d896ecac611ebcf029095d39d71
Opcode Fuzzy Hash: 255411c787cb7bf9a68f61edd8ce72405398ba63b8d21158fe6b48fda8096d73
Instruction Fuzzy Hash: 97F0F621D182093AEB20ABF4AC4AEBF7BB8EBCD314F000587F40CD6181E57189904752

Uniqueness

Uniqueness Score: -1.00%

Function 005EA530 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,FF74412D,00000000,00000000,?,?,?,FF74412D,?), ref: 005EA56C

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 3649c1f36e44b2c9fff94f496188c658d01d1c94279113fbef4cedb3358377a6
Instruction ID: fc06454bc3ef39c4b36ecb0551b7b4eb572e2b4bc1e9c26d003614ff6d57f5c5
Opcode Fuzzy Hash: 3649c1f36e44b2c9fff94f496188c658d01d1c94279113fbef4cedb3358377a6
Instruction Fuzzy Hash: 91E0923378130436E32061A9AC03FA7B78CEBC0B71F14002AFB4DEB2C2E595F90102A8

Uniqueness

Uniqueness Score: -1.00%

Function 005D76B4 Relevance: 1.5, APIs: 1, Instructions: 27threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0000000D,00008003,00000000,?,00000000), ref: 005D775B

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 567a9ba592bc978c789acd59bb901eff1ac2e425ea23a1ada8f07bc7bb1d7096
Instruction ID: 3c9f90c02bda2d9d3534fec51f2f667dcab25025af86951ac4af2cb5a748a477
Opcode Fuzzy Hash: 567a9ba592bc978c789acd59bb901eff1ac2e425ea23a1ada8f07bc7bb1d7096
Instruction Fuzzy Hash: CBE0260164E25C25E320975CDC82BB93F44EF4160AF0405AFEAC0C03C2E982000943E1

Uniqueness

Uniqueness Score: -1.00%

Function 005EBA30 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 005EBA5D

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
Instruction ID: bf78b2c6ff26a61909d7be63b7a1d6c882a09f6f8dafe08e630feaa23d700a48
Opcode Fuzzy Hash: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
Instruction Fuzzy Hash: E2E04FB12002046BD714DF49DC49ED73BACEF88750F018554FD095B241C530F914CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 005EBB90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,005DE2F2,005DE2F2,00000000,00000000,?,?), ref: 005EBBC0

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
Instruction ID: 3d13f02bb14c47e6c233801a16a31bda4eb458a35d8306a3175241f5fab732cc
Opcode Fuzzy Hash: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
Instruction Fuzzy Hash: EDE01AB12002086BD714DF49CC45EE737ADAF88650F118554BA095B241C630E8118AB1

Uniqueness

Uniqueness Score: -1.00%

Function 005DE797 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,005D892A,?), ref: 005DE7CB

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0a1a5353eabfc9dfef6403331c63342ff741c9c8305fec566e22e42327383a39
Instruction ID: 1308971384dd6fd21968c1b53796abd672513e01262dc05ca11a286993720955
Opcode Fuzzy Hash: 0a1a5353eabfc9dfef6403331c63342ff741c9c8305fec566e22e42327383a39
Instruction Fuzzy Hash: 84D02E3224030537F230AAA99C1BF663BCCEB88B40F06006AFA08EF3C3ED20E54105A4

Uniqueness

Uniqueness Score: -1.00%

Function 005EBA29 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 005EBA5D

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3aeb3cd17ae6284a15b46d812977de5e081e832d867c0209fc0817decf988025
Instruction ID: 2fa5a7bf3e080af2d6491cf0ae74eb62f2de96bbe0fb73ef8a91b418d921aa9f
Opcode Fuzzy Hash: 3aeb3cd17ae6284a15b46d812977de5e081e832d867c0209fc0817decf988025
Instruction Fuzzy Hash: FDE026B81002420BDB18FF69DCC08AB3BE1FF843003008949E85587617C631D456DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 005DE7A0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,005D892A,?), ref: 005DE7CB

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c2554325be551d02845fe289d871ff39bc72db2d89d10629a713e1b7d00bc901
Instruction ID: 1a83ec1445a9f5048d02ae141aedf20fb1e643b6d89ef5013e1b7f47279b366b
Opcode Fuzzy Hash: c2554325be551d02845fe289d871ff39bc72db2d89d10629a713e1b7d00bc901
Instruction Fuzzy Hash: 5FD0A77165030437F720E6E58C57F1632CCAB48B40F050064FA48EB3C3D960F5004164

Uniqueness

Uniqueness Score: -1.00%

Function 0325967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03259694

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c427e0ca437ad60eed4d5817d66b86bff1916fd733598b5ff203b7e1498be91f
Instruction ID: e8a0f298ed163755468a3dee0dc2ee9e0d88f3bd4f20dfeab5b0338d8948d84c
Opcode Fuzzy Hash: c427e0ca437ad60eed4d5817d66b86bff1916fd733598b5ff203b7e1498be91f
Instruction Fuzzy Hash: 6CB09B719124CEC5D611D771460871779447BD0751F16C051E1020641B4778C1D5F5F5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005E3E38 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 270windowCOMMON

Download Yara Rule

APIs

GetMenuState.USER32 ref: 005E4092

Strings

:, xrefs: 005E3ED7
e, xrefs: 005E3ED0
s, xrefs: 005E3EF3
U, xrefs: 005E3EAB
:, xrefs: 005E3EFA
P, xrefs: 005E3EEC
l, xrefs: 005E3EB2
U, xrefs: 005E3EC9

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: MenuState
String ID: :$:$P$U$U$e$l$s
API String ID: 1976172297-522774390
Opcode ID: 1e2cf8e347c9998e6e854eb45478d6bd66cd362c9b9d574337955d223d65fdc6
Instruction ID: a5f0ee4718aaefc3c44e66ff8bad98457f4a2fa34106e37d8f06c7dd148a1c0f
Opcode Fuzzy Hash: 1e2cf8e347c9998e6e854eb45478d6bd66cd362c9b9d574337955d223d65fdc6
Instruction Fuzzy Hash: 50A1ADB2A103499FDB18DFA5CC46BEEBBB5FF84310F00491DE1499B241EB78A901CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005E3E40 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 228windowCOMMON

Download Yara Rule

APIs

GetMenuState.USER32 ref: 005E4092

Strings

:, xrefs: 005E3ED7
e, xrefs: 005E3ED0
s, xrefs: 005E3EF3
U, xrefs: 005E3EAB
:, xrefs: 005E3EFA
P, xrefs: 005E3EEC
l, xrefs: 005E3EB2
U, xrefs: 005E3EC9

Memory Dump Source

Source File: 00000015.00000002.500415213.00000000005D0000.00000040.00000001.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5d0000_cmd.jbxd

Yara matches

Similarity

API ID: MenuState
String ID: :$:$P$U$U$e$l$s
API String ID: 1976172297-522774390
Opcode ID: ad12a60dcd5943d036610082bb7eb93abe617853a9f3e300245690735c2fbf60
Instruction ID: 5a57fa8defde0fe74feba8f15dd320c8a9274e3147a9b11e1590dffb6818eb04
Opcode Fuzzy Hash: ad12a60dcd5943d036610082bb7eb93abe617853a9f3e300245690735c2fbf60
Instruction Fuzzy Hash: 1E916BB1A10349AFDB14DFA5CC45BEEBBB8FF88310F04841DA5499B241EB78A901CB65

Uniqueness

Uniqueness Score: -1.00%

Function 032AFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E032AFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0325CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E032A5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E032A5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x032afdda
0x032afde2
0x032afde5
0x032afdec
0x032afdfa
0x032afdff
0x032afe0a
0x032afe0f
0x032afe17
0x032afe1e
0x032afe19
0x032afe19
0x032afe19
0x032afe20
0x032afe21
0x032afe22
0x032afe25
0x032afe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 032AFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 032AFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 032AFE2B

Memory Dump Source

Source File: 00000015.00000002.508279021.00000000031F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031F0000, based on PE: true

Associated: 00000015.00000002.509805651.000000000330B000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000015.00000002.509821446.000000000330F000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_31f0000_cmd.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 65c30dc442c49d0bfa1a4f7a378049738823e39f64f6f48b0e1dfc6cf3857cf6
Instruction ID: 0a436afcb305db44d5f15464c4031e509c05d2a0adef69b8e1f2a52ea5e33802
Opcode Fuzzy Hash: 65c30dc442c49d0bfa1a4f7a378049738823e39f64f6f48b0e1dfc6cf3857cf6
Instruction Fuzzy Hash: A7F04636210701BFDB209A49CD06F37FF5AEB40730F240315F6285A5D2EAA2F8A082F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SwiftMessage_Unlocked_Transaction ProofMessage.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SwiftMessage_Unlocked_Transaction ProofMessage.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fcnwidmg.j4k.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wrsvjmzf.aep.psm1

C:\Users\user\AppData\Local\Temp\tmpFDE9.tmp

C:\Users\user\AppData\Roaming\wKwiksScXFp.exe

C:\Users\user\AppData\Roaming\wKwiksScXFp.exe:Zone.Identifier

C:\Users\user\Documents\20220808\PowerShell_transcript.358075.dN3uju++.20220808173030.txt

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
SwiftMessage_Unlocked_Transaction ProofMessage.exe

Function 05660E2C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
COMMON

Function 05660E38 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Function 0150A470 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 192
COMMON

Function 015058AC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Function 015040A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Function 056633F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Function 0150BF94 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Function 0150C988 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Function 01509EA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
libraryCOMMON

Function 0150A8D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Function 01509EC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Function 0150A650 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Function 05661079 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON